Login
Sign-up
AboutIT4A
SHOPOT Products
SUPPLYSolutions
HOSTSolutions
PROTECTSolutions
CONNECTServices
UsefulRESOURCES
CONTACTIT4A

CVE-2025-0415: Command Injection Leading to Denial-of-Service in Secure Routers, Cellular Routers, and Network Security Appliances

Published: April 2, 2025

This Alert Is From MOXA

As Industrial IoT (IIoT) adoption continues to proliferate, cybersecurity has become one of the top priorities. The Moxa Product Security Incident Response Team (PSIRT) takes a proactive approach to protect products from cybersecurity vulnerabilities. Moxa PSIRT investigates all reports of vulnerabilities that could potentially affect Moxa products. Moxa created a vulnerability management policy to provide guidance and information to our customers in the event of a reported vulnerability. The management policy ensures that Moxa’s customers have steady, unambiguous resources to help them understand how Moxa resolves or mitigates reported vulnerabilities. For any queries, please email [email protected].

Multiple Moxa secure routers, cellular routers, and network security appliances are affected by a critical-severity vulnerability, CVE-2025-0415, which could allow an authenticated with administrative access to the web interface to execute arbitrary system commands on affected devices. 

To mitigate these risks, Moxa has released solutions for the affected products. It is strongly recommended to update to the latest version as soon as possible. 

The identified vulnerability types and potential impacts are listed below:

CVE ID Vulnerability Type Impact

CVE-2025-0415

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, resulting in a complete loss of connectivity for downstream systems that depend on its network services.

Vulnerability Scoring Details 

ID
Base Score
Vector

Unauthenticated

Remote Exploits
CVE-2025-0415

CVSS 4.0: 9.2

AV:N/AC:L/AT:N/PR:H/UI:N/

VC:H/VI:H/VA:H/SC:N/SI:N/SA:H 

 No

 

This alert has come from: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-259491-cve-2025-0415-command-injection-leading-to-denial-of-service-(dos)