CVE-2026-10828

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintended memory disclosure. Successful exploitation may allow an attacker to leak sensitive memory contents and determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR) protections.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-134

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Moxa	NPort W2150A-W4/W2250A-W4 Series	>= 1.0, <= 1.5
Moxa	NPort W2150A/W2250A Series	>= 1.0, <= 2.3

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v

Timeline

Published: Jun 16, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1082846.5IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensiti CVE-2026-108298.6A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerabili CVE-2026-1082919.8Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from CVE-2026-1082925.5IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that could be executed by ano CVE-2026-10834.4The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field configurati CVE-2026-108308.8The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not CVE-2026-1083016.0Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-1083024.3Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-1083038.8Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.CVE-2026-1083047.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-1083057.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-1083067.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.