CVE-2024-1220 is a high severity stack-based buffer overflow in the built-in web server of Moxa NPort W2150A and W2250A wireless device servers. Firmware 2.3 and earlier are affected and NVD scores it 8.2. The result is denial of service. Check Moxa's advisory MPSA-238975 for the fixed firmware.
What's affected
The record says firmware version 2.3 and prior on the NPort W2150A and W2250A series. The overflow sits in the web service, which a remote attacker can reach with a crafted request.
The stated impact in the record is denial of service. The vector shows network access, low complexity and no privileges, so a device with its web interface reachable would be exposed to anyone on that network path.
Moxa published the advisory as MPSA-238975. The page returned an error when I tried to fetch it, so I cannot confirm the fixed firmware number here. Do not guess a version. Open the advisory in your own browser and use the version it lists.
Weakness class: CWE-121, CWE-787. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H and a score of 8.2.
How to check if you're exposed
Log in to the device's web console and read the firmware version on the status or system information page. Exact menus vary by firmware. A version of 2.3 or lower is in the affected range.
Then list where these devices sit. Serial device servers often end up on flat plant or lab networks with the web interface left on. A network scan of your own address space for the device's web ports will show which units answer.
If you keep a software or hardware inventory, search it for the NPort W2150A and W2250A models and record the firmware beside each unit.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Find every NPort W2150A and W2250A unit and note its firmware version.
- Open Moxa advisory MPSA-238975 and download the fixed firmware it names.
- Schedule the firmware update, since the device will restart and serial links will drop briefly.
- Until then, restrict access to the device's web interface to a management network or a small set of admin hosts.
- Disable the web console where your workflow allows, and use another management method.
Why it matters
A stack-based buffer overflow (CWE-121, also filed under CWE-787) happens when code copies more data into a fixed buffer than it can hold. The excess data overwrites neighbouring memory on the stack. The record states the outcome as denial of service.
In an industrial setting a device that stops answering can interrupt a serial gateway that machines depend on. That is why availability matters here even without data theft. The record's KEV flag is false and I found no source reporting exploitation.
Quick check
Does this allow remote code execution?
The record only states denial of service. Do not assume more or less than the advisory says, and read MPSA-238975 for Moxa's own wording.
Where do I find the fixed firmware?
In Moxa advisory MPSA-238975. I could not load it, so the number is not stated here.
Sources
- NVD record for CVE-2024-1220
- Moxa advisory MPSA-238975 cited in the record (returned an error when fetched)
Last reviewed: 19 October 2026.
