The vulnerability is an improper validation of length parameters in the HTTPS management interface of Moxa’s Secure Router. This flaw allows an unauthenticated remote attacker to send specially crafted requests that trigger a buffer overflow. The overflow causes the web service to become unresponsive, leading to a denial‑of‑service condition that requires a device reboot to recover. No confidentiality or integrity impact has been identified; the issue solely affects availability.

The affected devices are Moxa EDR‑8010 Series and EDR‑G9010 Series routers running firmware version 3.24. Updating the router firmware or applying an official patch from Moxa is required to eliminate the vulnerability.

The CVSS score of 8.7 classifies this flaw as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Successful exploitation requires no authentication and can be performed over the HTTPS management interface, which is typically exposed on the network. Therefore, the attack vector is an unauthenticated remote HTTPS request that must reach the management service.