CVE-2026-10829

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insufficient input validation of user-supplied input in the "Server location" parameter on the Basic settings page. An attacker could exploit this vulnerability by sending crafted input to the web service, resulting in memory corruption. Successful exploitation of this vulnerability could allow remote code execution on the target system with root privileges.

Metrics

CVSS 4.0 8.6/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-121

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 16, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1082919.8Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: fromCVE-2026-10834.4The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field configuratiCVE-2026-108308.8The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is notCVE-2026-108316.9A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface doesCVE-2026-108325.9A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability bCVE-2026-108336.4The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site ScriptCVE-2026-1083347.4A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whCVE-2026-1083359.1When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attacCVE-2026-1083369.1When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate foCVE-2026-1083377.4An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included inCVE-2026-108344.6The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before movinCVE-2026-108357.7The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions