Moxa Ethernet Switches CVE-2025-1680

Exploitation requires the attacker to already possess administrative privileges on the affected Moxa Ethernet switch's web service (PR:L per vector, and 'administrative privileges' per description) - this is the primary limiting factor and makes exploitation post-authentication only. The attacker injects a crafted HTTP Host header into requests to the device's web service; successful real-world abuse additionally requires victim user interaction, i.e. a targeted user clicking a forged/redirect link (UI:P). Impact is confined to redirecting or phishing users via manipulated links and does not alter the device's own CIA. There is NO unauthenticated or default-configuration remote exploitation path.

This is a low-priority issue despite being a published CVE. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P) with ALL impact metrics set to None (VC:N/VI:N/VA:N/SC:N/SI:N/SA:N) yields an effective base severity at or near zero, consistent with the vendor's own statement that there is no confidentiality, integrity, or availability impact to the device or subsequent systems. The single most important limiting factor is PR:L combined with the description's explicit requirement for 'attackers with administrative privileges' - an attacker who already holds administrative access to the switch's web service is needed to exploit this, which collapses real-world risk. EPSS reinforces this: 0.18% probability at the 8th percentile indicates very low expected exploitation activity. There is no CISA KEV listing and no confirmed public exploit, so none of the escalating signals (active exploitation, automatable mass-exploitation) are present. Note a conflict worth flagging: the CVSS vector encodes network attack vector (AV:N) and impact metrics of None, yet the vulnerability class (Host Header Injection enabling phishing/redirect) inherently affects the integrity of what a victim user sees - the vendor scored downstream impact as N, which is defensible for the device but arguably understates the integrity effect on phished users. Overall: a legitimate but low-severity hygiene finding, not an urgent patching priority.

An attacker who has already obtained administrative credentials to a Moxa Ethernet switch's web management interface sends HTTP requests containing a specially crafted Host header to the device's web service. The injected header is reflected into generated links or redirect responses, so a targeted user who later clicks a forged link is sent to an attacker-controlled site for phishing. No public exploit code has been identified; a third-party technical writeup is referenced but does not constitute a confirmed POC.