CVE-2025-1679

published 2025-10-23

CVE-2025-1679: Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an…

Priority P4 26 medium 4.8 CVSS 4.0

AV N AC L AT N PR H UI P VC N VI N VA N SC L SI L SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is classified as stored cross-site scripting (XSS); attackers inject malicious scripts into the system, and the scripts persist across sessions. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of availability within any subsequent systems but has some loss of confidentiality and integrity within the subsequent system.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
moxa	tn-4500a_series	1.0 – 3.13	—
moxa	tn-5500a_series	1.0 – 3.13	—
moxa	tn-g4500_series	1.0 – 5.5	—
moxa	tn-g6500_series	1.0 – 5.5	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79