Which versions of Moxa NPort are affected by CVE-2026-10829?

Moxa NPort W2150A-W4/W2250A-W4 serial device servers with firmware 1.5 and earlier contain a critical vulnerability allowing authenticated administrators to gain complete system control.

How to fix or mitigate CVE-2026-10829?

Within 24 hours: Inventory all Moxa NPort W2150A-W4/W2250A-W4 devices, document firmware versions (1.5 and earlier), and implement strict administrative access controls (MFA and network ACLs). Within 7 days: Implement network segmentation for critical devices, enable comprehensive administrative activity logging, and establish alerts for suspicious admin access. Within 30 days: Apply vendor patch immediately upon availability from Moxa advisory MPSA-261910.

Moxa NPort CVE-2026-10829

Q: What is the CVSS score of CVE-2026-10829?

CVE-2026-10829 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-37063 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-16 Moxa

GHSA-v3px-7399-w24v

RCE Buffer Overflow Stack Overflow Nport W2150A W4 W2250A W4 Series Nport W2150A W2250A Series Moxa

8.6

CVSS 4.0 · Vendor: Moxa

Severity by source

Vendor (Moxa) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Reachable over the network via the web UI with low complexity, but requires administrator login (PR:H) to hit the Basic settings handler; full root RCE gives C/I/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Moxa).

CVSS VectorVendor: Moxa

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 11:52 vuln.today

DescriptionCVE.org

A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insufficient input validation of user-supplied input in the "Server location" parameter on the Basic settings page. An attacker could exploit this vulnerability by sending crafted input to the web service, resulting in memory corruption. Successful exploitation of this vulnerability could allow remote code execution on the target system with root privileges.

AnalysisAI

Remote code execution in Moxa NPort W2150A-W4/W2250A-W4 Series firmware version 1.5 and earlier allows authenticated administrators to corrupt memory by submitting an overlong 'Server location' value on the Basic settings page of the web management interface, yielding root-level command execution on the embedded serial device server. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but Moxa has issued advisory MPSA-261910 confirming the flaw. The companion CVE-2026-10828 (format string) was disclosed in the same advisory, suggesting the web management stack received broader scrutiny.

Technical ContextAI

Moxa NPort W2150A-W4/W2250A-W4 are industrial serial-to-Ethernet device servers that bridge legacy RS-232/422/485 equipment onto TCP/IP networks, commonly deployed in OT and ICS environments. The web-based configuration interface processes the 'Server location' field on the Basic settings page without enforcing length bounds, fitting CWE-121 (Stack-based Buffer Overflow): user-supplied input is copied into a fixed-size automatic stack buffer, enabling return-address or saved-frame-pointer overwrite. Because embedded firmware of this class typically lacks modern mitigations such as full ASLR, stack canaries, or non-executable stacks, a controlled overflow on the parsing path of a privileged HTTP handler maps directly to arbitrary code execution as root.

RemediationAI

Patch available per vendor advisory MPSA-261910 at https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v - apply the firmware update Moxa publishes for the W2150A-W4/W2250A-W4 series above version 1.5 (specific fixed build not enumerated in the provided data, confirm with Moxa support). Until firmware can be staged, restrict the device's web management interface to a dedicated management VLAN and an allowlist of administrator workstations via firewall ACLs, since the bug requires PR:H and is reached through the HTTP configuration UI; disabling unused management protocols (HTTP/HTTPS on WAN-facing interfaces) eliminates external exposure at the cost of remote configuration convenience. Rotate any shared or default administrator credentials and enable account lockout where supported, because the entire exploit prerequisite collapses to whoever holds an admin login.