Tn 4500B Series
Monthly
Pre-authentication denial of service in the Moxa TN-4500B series Ethernet switches: improper validation of the username field length during Web login processing lets a remote, unauthenticated attacker send an overly long username that overflows a buffer and crashes the authentication process. No credentials (PR:N) and no user interaction (UI:N) are required, so any TN-4500B switch whose HTTP/HTTPS management login is reachable from the attacker's network is at risk, and the vendor-supplied CVSS 4.0 vector scores it 8.8 with availability impact rated High. The exploit's practical constraint is exposure rather than complexity - switches with web management confined to an isolated OT/management VLAN are not reachable and therefore not exploitable. Realized impact is limited to a crash-driven loss of availability; no data disclosure or confirmed code execution has been demonstrated, and no public exploit code was identified at time of analysis.
Pre-authentication denial of service in the Moxa TN-4500B series Ethernet switches: improper validation of the username field length during Web login processing lets a remote, unauthenticated attacker send an overly long username that overflows a buffer and crashes the authentication process. No credentials (PR:N) and no user interaction (UI:N) are required, so any TN-4500B switch whose HTTP/HTTPS management login is reachable from the attacker's network is at risk, and the vendor-supplied CVSS 4.0 vector scores it 8.8 with availability impact rated High. The exploit's practical constraint is exposure rather than complexity - switches with web management confined to an isolated OT/management VLAN are not reachable and therefore not exploitable. Realized impact is limited to a crash-driven loss of availability; no data disclosure or confirmed code execution has been demonstrated, and no public exploit code was identified at time of analysis.