High severity · published Jun 16, 2026
CVE-2026-10829
A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier
8.6
CVSS
0.5%
EPSS
No
On KEV
Description
A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insufficient input validation of user-supplied input in the "Server location" parameter on the Basic settings page. An attacker could exploit this vulnerability by sending crafted input to the web service, resulting in memory corruption. Successful exploitation of this vulnerability could allow remote code execution on the target system with root privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NW
NPort W2150A-W4/W2250A-W4 Series · Moxa
1.0 through 1.5 · source: vendor
NW
NPort W2150A/W2250A Series · Moxa
1.0 through 2.3 · source: vendor
Affected product
NW
NPort W2150A-W4/W2250A-W4 Series
Moxa
More from NPort W2150A-W4/W2250A-W4 Series
6.9
CVE-2026-10828
A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior
5.3
CVE-2026-111548
A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers