Moxa NPort W2150A-W4 CVE-2026-111548

Exploitation requires authenticated access to the web management interface of a Moxa NPort W2150A-W4/W2250A-W4 Series device with at least low-privilege credentials (PR:L); it is not an unauthenticated flaw. The attacker must be able to reach the management interface over the network and supply input to the vulnerable field that exceeds the expected bounds (insufficient bounds checking per CWE-121). Limiting factors: valid low-privilege credentials are mandatory, no user interaction by a victim is needed, and the impact is confined to making the web management service unresponsive - other device functions keep running and recovery only needs a power cycle, so this is a management-plane denial of service rather than code execution or data compromise. Applies to firmware versions 1.0 through 1.5.

This is a medium-severity, availability-only issue (CVSS 4.0 base 5.3) that in practice sits below true priority status. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity flaw but one that requires low-level authentication (PR:L) and yields only limited availability impact (VA:L) with no confidentiality or integrity loss - the overflow renders the web management service unresponsive while the rest of the device keeps functioning, and recovery is a power cycle rather than a crash of the data path. The vendor's own priority label is 'this_month' (not act_now/emergency), which is consistent with the limited impact. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore internally consistent - moderate exploitability gated by authentication, minor impact, no exploitation evidence - rather than conflicting. The main caveat: the CVSS is network-vector but the only confirmed consequence is a self-contained denial of the management plane, so the realistic worst case for an attacker who already holds valid low-privilege credentials is nuisance-level disruption of remote administration, not device takeover.

An attacker who already holds low-privilege credentials for the device's web management interface sends crafted, oversized input to a vulnerable field, overrunning a stack buffer and crashing the web management service so remote administration is lost until someone physically power cycles the unit. No public proof-of-concept or exploit code is referenced in the available data. Because the flaw is network-reachable with low complexity, the practical barrier is obtaining valid authentication rather than exploitation difficulty.