Is CVE-2026-10829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10829 being exploited in the wild.

How severe is CVE-2026-10829?

Informational severity, with a CVSS score of 8.6, published 16 June 2026.

Which products and versions are affected?

Moxa NPort W2150A Series 2.3 and earlier; Moxa NPort W2150A-W4 Series 1.5 and earlier; Moxa NPort W2250A Series 2.3 and earlier; Moxa NPort W2250A-W4 Series 1.5 and earlier.

Is there a fix for CVE-2026-10829?

A patch was published on 2026-06-16: Firmware v1.5.1 released for W4 series Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10829 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-10829?

Check whether you run Moxa NPort W2150A Series, Moxa NPort W2150A-W4 Series, Moxa NPort W2250A Series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10829: Moxa NPort W2150A/W2250A stack overflow in Server location parameter

CVE-2026-10829 · Severity: info · CVSS 8.6 · Published 2026-06-16

Moxa NPort serial device servers, which are used to connect industrial serial equipment to Wi-Fi networks, are vulnerable to a critical security flaw. An attacker with administrative access can send specially crafted data to the device's web management interface to crash the system or take full control of it. If exploited, this could allow an attacker to disrupt industrial operations or manipulate data flowing through the device.

Technologies: Moxa NPort W2150A Series, Moxa NPort W2150A-W4 Series, Moxa NPort W2250A Series, Moxa NPort W2250A-W4 Series. Vendors: Moxa.

Quick answers

Is CVE-2026-10829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10829 being exploited in the wild.
How severe is CVE-2026-10829?: Informational severity, with a CVSS score of 8.6, published 16 June 2026.
Which products and versions are affected?: Moxa NPort W2150A Series 2.3 and earlier; Moxa NPort W2150A-W4 Series 1.5 and earlier; Moxa NPort W2250A Series 2.3 and earlier; Moxa NPort W2250A-W4 Series 1.5 and earlier.
Is there a fix for CVE-2026-10829?: A patch was published on 2026-06-16: Firmware v1.5.1 released for W4 series Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10829 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-10829?: Check whether you run Moxa NPort W2150A Series, Moxa NPort W2150A-W4 Series, Moxa NPort W2250A Series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in the web management interface of Moxa NPort W2150A-W4 and W2250A-W4 series devices. The vulnerability is located in the 'Server location' parameter on the Basic settings page due to insufficient validation of user-supplied input. An attacker with high privileges (PR:H) can exploit this over the network by submitting a crafted string that overflows the stack buffer, leading to memory corruption. Successful exploitation enables remote code execution with root-level permissions. A firmware patch (v1.5.1) is available for the W4 series, while older phased-out models require hardware replacement.

Affected products

Moxa NPort W2150A-W4 Series 1.5 and earlier
Moxa NPort W2250A-W4 Series 1.5 and earlier
Moxa NPort W2150A Series 2.3 and earlier
Moxa NPort W2250A Series 2.3 and earlier

Timeline

2026-06-16: disclosed
2026-06-16: advisory
2026-06-16: patched: Firmware v1.5.1 released for W4 series

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.