CVE-2026-10828 is a format string vulnerability (CWE-134) affecting the "alias" parameter on the Serial Param configuration page of Moxa NPort W2150A-W4/W2250A-W4 Series firmware version 1.0 and earlier. The flaw arises from inadequate input validation and unsafe handling of externally controlled format strings, which can be exploited by sending crafted input to the device's web service. Successful exploitation may cause disclosure of sensitive memory contents and enable attackers to determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR). The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). No patch or official remediation has been published by Moxa as of the data provided.

Exploitation of this vulnerability can lead to unintended disclosure of memory contents, potentially exposing sensitive information. Additionally, it may allow attackers to bypass ASLR protections by revealing critical memory addresses. This could facilitate further attacks against the device or network. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's web interface to trusted users only and monitor for suspicious input targeting the "alias" parameter. Avoid exposing the device management interface to untrusted networks.