Moxa NPort CVE-2026-10829

Exploitation requires (1) network reach to the NPort device's web management interface (HTTP/HTTPS) - typically TCP/80 or TCP/443 on the management VLAN; (2) valid administrator credentials sufficient to load and submit the Basic settings page, as encoded by PR:H in the CVSS vector; and (3) the device must be running firmware version 1.5 or earlier of the NPort W2150A-W4/W2250A-W4 Series (or the related W2150A/W2250A line). Exploitation is LIMITED by the authentication requirement (no anonymous exploitation path is documented), by the need to reach the management UI through whatever segmentation the operator has deployed, and by the embedded-specific payload work required since no public POC is referenced.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H produces a base score of 8.6, reflecting full compromise of the device but requiring high privileges (administrative web login) to reach the vulnerable Basic settings parameter. There is no EPSS score, no KEV listing, and no POC referenced in the inputs, so realistic risk is bounded by an attacker first obtaining admin credentials - frequently a low bar on industrial gear where default or shared credentials persist, and where these devices are routinely exposed via management VLANs. Net effect: high-impact post-authentication RCE on OT infrastructure, but not a drop-everything internet-exploitable bug; prioritize where these NPort units are reachable from corporate networks or shared with untrusted operators. One data caveat - PR:H from Moxa likely reflects the documented admin requirement, but no auth bypass has been ruled out by an independent analyst review in the provided data.

An attacker who has phished, brute-forced, or harvested an administrator credential for the NPort web UI logs in over HTTP/HTTPS, navigates to the Basic settings page, and submits an oversized 'Server location' value crafted to overwrite the saved return address with a payload pointer. The handler returns into attacker-controlled shellcode (or a ROP chain on hardened builds), and the attacker gains root execution on the device - enabling pivoting onto the attached serial bus, persistent OT foothold, or traffic interception. No public exploit is identified at time of analysis, so weaponization requires firmware reverse engineering.