CVE-2026-10829 Overview
CVE-2026-10829 is a stack-based buffer overflow [CWE-121] affecting the Moxa NPort W2150A-W4 and W2250A-W4 Series wireless serial device servers running firmware version 1.5 and earlier. The vulnerability stems from insufficient input validation of the Server location parameter on the Basic settings page of the device's web service. An attacker who can reach the management interface and authenticate with high privileges can send a crafted value to trigger memory corruption on the stack. Successful exploitation allows remote code execution with root privileges on the affected device.
Critical Impact
Exploitation grants root-level remote code execution on industrial serial-to-Ethernet gateways, providing a foothold to pivot into operational technology (OT) networks.
Affected Products
- Moxa NPort W2150A-W4 Series, firmware version 1.5 and earlier
- Moxa NPort W2250A-W4 Series, firmware version 1.5 and earlier
Discovery Timeline
- 2026-06-16 - CVE-2026-10829 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-10829
Vulnerability Analysis
The NPort W2150A-W4 and W2250A-W4 Series are wireless serial device servers used to bridge legacy RS-232/422/485 equipment onto IP networks. Their embedded web server exposes a Basic settings page where administrators configure device metadata, including a Server location string. The handler that processes this parameter copies the supplied value into a fixed-size stack buffer without verifying the input length. Supplying a value that exceeds the buffer size overwrites adjacent stack memory, including the saved return address. By placing controlled data in the overflowed region, an attacker can redirect execution to attacker-supplied instructions and obtain code execution in the context of the web service, which runs as root on the device.
Root Cause
The defect is a classic missing bounds check on user-supplied input prior to an unsafe copy into a stack buffer, consistent with [CWE-121] Stack-based Buffer Overflow. The web service trusts the length and content of the Server location field from the Basic settings form, allowing the input to overflow the destination buffer and corrupt control-flow data on the stack.
Attack Vector
Exploitation is performed over the network against the device's HTTP management interface. The attacker must possess high-privilege credentials to reach the Basic settings page, after which a crafted POST request containing an oversized Server location value triggers the overflow. The vulnerability requires no user interaction. Because NPort devices are frequently deployed at the IT/OT boundary, a compromised gateway can be used to inspect, modify, or inject serial traffic destined for industrial controllers.
No public proof-of-concept exploit is referenced in the advisory. The vulnerability mechanism — an unbounded copy of the Server location form field into a stack buffer — is described in prose only; refer to the Moxa Security Advisory MPSA-261910 for vendor-confirmed technical details.
Detection Methods for CVE-2026-10829
Indicators of Compromise
- Unexpected reboots, watchdog resets, or web service crashes on NPort W2150A-W4 / W2250A-W4 devices following configuration requests.
- HTTP POST requests to the Basic settings endpoint containing abnormally long Server location values or non-printable byte sequences.
- Outbound connections originating from the NPort device to unknown IP addresses, indicating possible post-exploitation activity.
Detection Strategies
- Inspect web server logs and network captures for oversized form fields submitted to the device administration interface.
- Baseline expected administrative source IPs and alert on authenticated configuration changes from unexpected hosts.
- Monitor SNMP and syslog feeds from the device for service restarts that correlate with configuration POSTs.
Monitoring Recommendations
- Forward NPort syslog output to a centralized log platform and alert on repeated web service faults.
- Place the device management VLAN behind an IDS/IPS with signatures for oversized HTTP form parameters targeting Moxa endpoints.
- Track administrative account usage and rotate credentials if unauthorized logins are observed.
How to Mitigate CVE-2026-10829
Immediate Actions Required
- Apply the firmware update referenced in Moxa Security Advisory MPSA-261910 as soon as it is available for your device model.
- Restrict access to the device's HTTP management interface to a dedicated administrative network or jump host.
- Rotate administrator credentials and disable any default or shared accounts on affected NPort devices.
Patch Information
Moxa has published advisory MPSA-261910 covering CVE-2026-10828 and CVE-2026-10829 for the NPort W2150A-W4 and W2250A-W4 Series. Customers should consult the advisory for the fixed firmware version and upgrade instructions. Devices running firmware 1.5 and earlier remain vulnerable until upgraded.
Workarounds
- Disable the web-based management interface where serial-only or CLI management is sufficient for operations.
- Place affected devices behind a firewall that denies inbound HTTP/HTTPS traffic from untrusted segments.
- Enforce network segmentation between IT and OT zones so that only authorized engineering workstations can reach the NPort management plane.
- Configure ACLs on upstream switches to limit which source addresses can initiate sessions to the device.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
