CVE-2026-10828: Input Validation
A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintended memory disclosure. Successful exploitation may allow an attacker to leak sensitive memory contents and determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR) protections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the web management interface is not required, disable the web management service on the device or otherwise disable the serial-param 'alias' editing UI to prevent external input to the vulnerable page.
NPort W2150A-W4 / W2250A-W4 web management interface web_management_interface_enabled = false (if not required) - Compensating control
Restrict access to the device's web service (management interface) to trusted hosts/networks only. Implement firewall rules, ACLs, or network segmentation to block untrusted or Internet access to the management port and web interface.
- Operational
Monitor device logs and network traffic for attempts to access the Serial Param/alias page and for signs of memory disclosure or exploitation. Contact the vendor and follow the vendor security advisory for this issue; apply any vendor-supplied firmware update or official patch as soon as it is made available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10828?
CVE-2026-10828 has a medium severity rating of 6.9 on the CVSS scale.
How do I fix CVE-2026-10828?
To mitigate CVE-2026-10828, ensure that you upgrade to the latest firmware version of the MOXA NPort W2150A-W4/W2250A-W4 Series that addresses this vulnerability.
What type of vulnerability is CVE-2026-10828?
CVE-2026-10828 is identified as a format string vulnerability due to insufficient input validation.
Which products are affected by CVE-2026-10828?
CVE-2026-10828 affects the MOXA NPort W2150A-W4 and W2250A-W4 Series, specifically versions 1.5 and prior.
When was CVE-2026-10828 published?
CVE-2026-10828 was published on June 16, 2026.