CVE-2025-0415: falha crítica em Moxa EDF-G1002-BP Series
Command Injection in NTP Setting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.2epss 0.5%
A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for downstream systems that rely on its network services.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H
Produtos afetados
Moxa · EDF-G1002-BP SeriesMoxa · EDR-8010 SeriesMoxa · EDR-810 SeriesMoxa · EDR-G9004 SeriesMoxa · EDR-G9010 SeriesMoxa · NAT-102 SeriesMoxa · OnCell G4302-LTE4 SeriesMoxa · TN-4900 SeriesCVEs relacionadas — Moxa EDF-G1002-BP Series
No mesmo produto, das mais perigosas para as menos.
CVE-2024-9140CRITICALCVE-2024-9140EPSS 1.8%CVE-2024-9139HIGHOS Command Injection in Restricted CommandEPSS 1.4%CVE-2023-33239HIGHSecond Order Command-injection Vulnerability in the Key-generation FunctionEPSS 1.3%CVE-2024-9138HIGHPrivilege Escalation in Cellular Router, Secure Router, and Network Security AppliancesEPSS 1.1%CVE-2025-0676HIGHCommend Injection Leading to Privilege EscalationEPSS 1.0%CVE-2023-33238HIGHCommand-injection Vulnerability in Certificate ManagementEPSS 0.8%