Moxa NPort W2150A/W2250A CVE-2026-10828

Q: What is the CVSS score of CVE-2026-10828?

CVE-2026-10828 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37062 MEDIUM

Use of Externally-Controlled Format String (CWE-134)

2026-06-16 Moxa

GHSA-pgjf-23qm-f427

Information Disclosure Nport W2150A W4 W2250A W4 Series Nport W2150A W2250A Series Moxa

6.9

CVSS 4.0 · Vendor: Moxa

Severity by source

Vendor (Moxa) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.9 MEDIUM

Admin credentials gate the Serial Param page (PR:H); no scope change or integrity/availability impact - pure network-reachable stack read.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Moxa).

CVSS VectorVendor: Moxa

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 11:53 vuln.today

DescriptionCVE.org

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintended memory disclosure. Successful exploitation may allow an attacker to leak sensitive memory contents and determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR) protections.

AnalysisAI

Format string exploitation in Moxa NPort W2150A-W4/W2250A-W4 and W2150A/W2250A series wireless serial device servers (firmware v1.5 and prior) allows network-accessible, authenticated administrators to leak arbitrary stack memory through the web management interface. The 'alias' parameter on the Serial Param configuration page passes attacker-controlled input directly to a printf-family function without sanitization, violating CWE-134. The disclosed memory contents can be used to defeat ASLR, making this vulnerability a likely prerequisite stepping-stone to CVE-2026-10829 (stack-based buffer overflow) documented in the same Moxa advisory MPSA-261910. No public exploit and no CISA KEV listing are identified at time of analysis.

Technical ContextAI

CWE-134 (Use of Externally-Controlled Format String) arises when user-supplied data is passed as the format string argument - rather than a format argument value - to a C-family printf-like function. Specifiers such as %x, %s, or %n then read from or write to the stack, disclosing or corrupting arbitrary memory. The affected devices (CPE: cpe:2.3:a:moxa:nport_w2150a-w4/w2250a-w4_series and cpe:2.3:a:moxa:nport_w2150a/w2250a_series) are industrial wireless serial-to-IP device servers widely deployed in OT/ICS environments to bridge legacy RS-232/422/485 serial equipment onto Ethernet networks. The vulnerable code path resides in the HTTP-based web management interface, specifically in the handler for the 'alias' field of the Serial Param configuration page, running on firmware version 1.5 and prior across both the standard (W2150A/W2250A) and extended-variant (W2150A-W4/W2250A-W4) product lines.

RemediationAI

Consult Moxa advisory MPSA-261910 at https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v for the recommended firmware upgrade; the specific fixed firmware version number is not confirmed in the available data and must be verified from that source before deployment. As compensating controls pending patching: restrict network access to the NPort web management interface to dedicated management VLANs or jump hosts using firewall ACLs - this eliminates the AV:N attack surface without device changes and has no operational side effect on serial data-path traffic. Rotate all administrator credentials away from factory defaults, enforce unique strong passwords per device, and audit which personnel hold admin access, since PR:H is the primary barrier against exploitation. Disable web management entirely if remote configuration is not operationally required, noting that this would prevent browser-based administration until re-enabled. Given that CVE-2026-10829 (buffer overflow) shares this advisory, both vulnerabilities should be remediated together to prevent chained exploitation.