Moxa Ethernet Switches CVE-2025-1679

Exploitation requires the attacker to already possess authenticated administrative access to the switch's web management service (PR:H), so this is not a remote-unauthenticated flaw despite the AV:N network vector. The malicious script is stored persistently in the device's web service, and triggering the payload requires a second authenticated user to interact with the affected page of the web interface (UI:P). Limiting factors: the high administrative privilege prerequisite, the dependence on victim interaction with the web UI, and the absence of any impact to the device's own confidentiality, integrity, or availability - impact is limited to other users' browser sessions. Realistic risk is therefore confined to environments where multiple users share administrative access to the device UI.

This is a genuinely low-to-moderate priority issue, not a critical one, and the signals are largely consistent. The CVSS 4.0 base score of 4.8 (Medium) reflects the key constraint: PR:H means exploitation requires an already-authenticated administrative account on the device, and UI:P means a victim user must interact with the web interface for the stored payload to fire. EPSS is low at 0.33% (24th percentile), which aligns with the high-privilege barrier - mass automated exploitation is implausible because an attacker must first hold admin credentials. There is no CISA KEV listing and no confirmed public exploit, so there is no evidence of active exploitation. The impact is confined to the 'subsequent system' (SC:L/SI:L) - i.e., the browser/session of other users viewing the device UI - with explicitly no confidentiality, integrity, or availability impact to the switch itself (VC:N/VI:N/VA:N). The primary caveat: the vendor-supplied vector sets UI:P (passive) while a stored XSS typically requires a victim to load the affected page, which is a reasonable passive-interaction model, but defenders should note the realistic precondition is that a second privileged user views attacker-controlled content. No signals conflict materially; the main limiting factor (admin privilege requirement) is the dominant risk reducer.

An attacker who already holds administrative web credentials on a Moxa Ethernet switch injects a malicious script into a stored field in the device's web service. When another authenticated user later opens the affected page in the web interface, the persisted script executes in their browser session, potentially stealing session context or performing actions in that user's context. No public exploit code has been identified, and exploitation requires both prior administrative access and a second user interacting with the UI.