CVE-2026-10828: Moxa Nport w2150a-w4/w2250a-w4 Series

Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days.

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintended memory disclosure. Successful exploitation may allow an attacker to leak sensitive memory contents and determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR) protections.

Affected products

• Moxa Nport w2150a-w4/w2250a-w4 Series: from 1.0, up to and including 1.5
• Moxa Nport w2150a/w2250a Series: from 1.0, up to and including 2.3

Published 2026-06-16. Last modified 2026-06-17.