CVE-2026-10828

Externally Controlled Format String Vulnerability in Moxa NPort Serial Parameter Configuration

Published Jun 16, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintended memory disclosure. Successful exploitation may allow an attacker to leak sensitive memory contents and determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR) protections.

Analysis

Technical impact

A format string vulnerability exists in the 'alias' parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series firmware version 1.5 and earlier. Insufficient input validation allows an attacker to send a crafted string to the web service that is interpreted as a format string, exposing sensitive memory contents and critical addresses. This can lead to information disclosure and, by revealing address layouts, may assist in bypassing ASLR protections.

Affected Systems

Products affected are the Moxa NPort W2150A-W4 and W2250A-W4 Series, as well as the NPort W2150A and W2250A Series. Firmware versions 1.5 and all earlier releases are vulnerable. The issue resides in the web-based configuration interface exposed on the device.

Risk and Exploitability

The CVSS score of 6.9 and the EPSS score of < 1% suggest a moderate severity and a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the web interface, and successful exploitation would enable memory disclosure and potentially aid further attacks. No local privilege requirement is stated, implying that any user with network access to the web service could exploit it.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Moxa

NPort W2150A-W4/W2250A-W4 Series

unaffected

Version	Status	Constraints
`1.0`	affected	≤ 1.5

Moxa

NPort W2150A/W2250A Series

unaffected

Version	Status	Constraints
`1.0`	affected	≤ 2.3

No data.

Vendor Product Versions

Moxa

Nport W2150a-w4 W2250a-w4 Series

Version	Status	Scheme	Platform
`[1.0,1.5]`	affected	generic	—

Moxa

Nport W2150a W2250a Series

Version	Status	Scheme	Platform
`[1.0,2.3]`	affected	generic	—

Remediation

Vendor Solution

Please refer to the security advisory: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v

OpenCVE Recommended Actions

Apply the firmware update referenced in the Moxa security advisory.
Disable or restrict access to the web configuration interface if it is not required.
Monitor the web service for unexpected requests and review logs for potential exploitation attempts.

Generated by OpenCVE AI on June 17, 2026 at 22:38 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.310% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v

History

Jun 18, 2026 4:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Externally Controlled Format String Vulnerability in Moxa NPort Serial Parameter Configuration

Jun 16, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 11:30 AM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintended memory disclosure. Successful exploitation may allow an attacker to leak sensitive memory contents and determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR) protections.
First Time appeared		Moxa Moxa nport W2150a-w4 W2250a-w4 Series Moxa nport W2150a W2250a Series
Weaknesses		CWE-134
CPEs		cpe:2.3:a:moxa:nport_w2150a-w4_w2250a-w4_series:::::::: cpe:2.3:a:moxa:nport_w2150a_w2250a_series::::::::
Vendors & Products		Moxa Moxa nport W2150a-w4 W2250a-w4 Series Moxa nport W2150a W2250a Series
References		https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`