Is CVE-2026-10828 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10828 being exploited in the wild.

How severe is CVE-2026-10828?

Informational severity, with a CVSS score of 6.9, published 16 June 2026.

Which products and versions are affected?

Moxa NPort W2150A Series 2.3 and prior; Moxa NPort W2150A-W4 Series 1.5 and prior; Moxa NPort W2250A Series 2.3 and prior; Moxa NPort W2250A-W4 Series 1.5 and prior.

Is there a fix for CVE-2026-10828?

A patch was published on 2026-06-16: Firmware v1.5.1 released for W4 series Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10828 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10828?

Check whether you run Moxa NPort W2150A Series, Moxa NPort W2150A-W4 Series, Moxa NPort W2250A Series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10828: Moxa NPort W2150A/W2250A format string vulnerability in alias parameter

CVE-2026-10828 · Severity: info · CVSS 6.9 · Published 2026-06-16

Moxa NPort serial device servers, which connect industrial serial equipment to wireless networks, contain a security flaw in their web configuration interface. An attacker with administrative privileges can exploit this flaw to view sensitive information stored in the device's memory. This could lead to the exposure of system secrets or help an attacker bypass other security protections to gain further control over the device.

Technologies: Moxa NPort W2150A Series, Moxa NPort W2150A-W4 Series, Moxa NPort W2250A Series, Moxa NPort W2250A-W4 Series. Vendors: Moxa.

Quick answers

Is CVE-2026-10828 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10828 being exploited in the wild.
How severe is CVE-2026-10828?: Informational severity, with a CVSS score of 6.9, published 16 June 2026.
Which products and versions are affected?: Moxa NPort W2150A Series 2.3 and prior; Moxa NPort W2150A-W4 Series 1.5 and prior; Moxa NPort W2250A Series 2.3 and prior; Moxa NPort W2250A-W4 Series 1.5 and prior.
Is there a fix for CVE-2026-10828?: A patch was published on 2026-06-16: Firmware v1.5.1 released for W4 series Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10828 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10828?: Check whether you run Moxa NPort W2150A Series, Moxa NPort W2150A-W4 Series, Moxa NPort W2250A Series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A format string vulnerability (CWE-134) exists in the 'alias' parameter of the Serial Param configuration page within the web-based management interface. The issue results from insufficient validation of user-supplied input before it is processed by a format-string-aware function. A remote attacker with high privileges (PR:H) can submit crafted input containing format specifiers to leak sensitive memory contents. This disclosure can be used to identify critical memory addresses, effectively bypassing Address Space Layout Randomization (ASLR) and facilitating further exploitation. A security patch (v1.5.1) is available for the W4 series, while older phased-out models require hardware replacement.

Affected products

Moxa NPort W2150A-W4 Series 1.5 and prior
Moxa NPort W2250A-W4 Series 1.5 and prior
Moxa NPort W2150A Series 2.3 and prior
Moxa NPort W2250A Series 2.3 and prior

Timeline

2026-06-16: disclosed
2026-06-16: advisory
2026-06-16: patched: Firmware v1.5.1 released for W4 series

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.