CVE-2025-1680noneCWE-349

CVE-2025-1680: vulnerability in Moxa TN-4500A Series

Published

Follow this CVE+ Monitor TN-G4500 Series+ Monitor TN-G6500 Series

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 0epss 0.2%
An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected device’s web service. This vulnerability is classified as Host Header Injection, where invalid Host headers can manipulate to redirect users, forge links, or phishing attacks. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of confidentiality, integrity, and availability within any subsequent systems.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Moxa · TN-4500A SeriesMoxa · TN-5500A SeriesMoxa · TN-G4500 SeriesMoxa · TN-G6500 Series
Related CVEs — Moxa TN-4500A Series

In the same product, most dangerous first.

CVE-2024-7695HIGHOut-of-bounds Write VulnerabilityEPSS 0.7%CVE-2024-9137HIGHMoxa Service Missing Authentication for Critical FunctionEPSS 0.5%CVE-2025-1679MEDIUMCVE-2025-1679EPSS 0.3%