CVE-2026-10828

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintended memory disclosure. Successful exploitation may allow an attacker to leak sensitive memory contents and determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR) protections.

• CWE-134

• https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v

Published

Jun 16, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10820The Paid Membership Plugin, Ecommerce, User Registration For…8.1
• CVE-2026-10822If BIND encounters a particular invalid data structure in a …6.5
• CVE-2026-10823The YMC Filter WordPress plugin before 3.11.3 does not prope…7.5
• CVE-2026-10824The Masteriyo LMS WordPress plugin before 2.2.1 does not pe…6.5
• CVE-2026-10825A denial-of-service vulnerability exists in the WebSocket AP…7.1
• CVE-2026-10827The Spectra Legacy WordPress plugin before 2.20.0 does not …3.5
• CVE-2026-10829A stack-based buffer overflow vulnerability has been found i…8.6
• CVE-2026-1083The Appointment Hour Booking – Booking Calendar plugin for W…4.4
• CVE-2026-10830The AllCoach WordPress plugin before 1.0.2 does not verify …8.8
• CVE-2026-10831A denial-of-service vulnerability exists in NPort devices be…6.9
• CVE-2026-10833The Gutenberg Essential Blocks – Page Builder for Gutenberg …6.4
• CVE-2026-10834The WP Travel Engine WordPress plugin before 6.8.1 does not…4.6