CVE-2025-0676

published 2025-04-02

CVE-2025-0676: This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input…

Priority P3 52 high 8.6 CVSS 4.0

AV N AC L AT N PR H UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input validation to inject and execute systems commands. Successful exploitation could result in privilege escalation, allowing the attacker to gain root shell access and maintain persistent control over the device, potentially disrupting network services and affecting the availability of downstream systems that rely on its connectivity.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
moxa	edf-g1002-bp_series	1.0 – 3.14	—
moxa	edr-8010_series	1.0 – 3.14	—
moxa	edr-810_series	1.0 – 5.12.39	—
moxa	edr-g9004_series	1.0 – 3.14	—
moxa	edr-g9010_series	1.0 – 3.14	—
moxa	nat-102_series	1.0 – 3.15	—
moxa	oncell_g4302-lte4_series	1.0 – 3.14	—
moxa	tn-4900_series	1.0 – 3.14	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78