CVE-2025-1679

Vulnerability

Overview

CVE-2025-1679 is a stored cross-site scripting (XSS) vulnerability in Moxa's Ethernet switches. An authenticated attacker with administrative privileges can inject malicious scripts into the device's web service. These scripts persist across sessions, meaning they are stored on the device and executed whenever other authenticated users interact with the affected web interface [1].

Exploitation and

Attack Surface

The attack requires administrative access to the device's web interface. Once authenticated, the attacker injects the malicious script through a vulnerable input field. The script is then stored and served to other authenticated users who visit the affected page. No user interaction beyond normal browsing is needed for the stored script to execute [1].

Impact

Successful exploitation leads to a loss of confidentiality and integrity for the subsequent system (the browser of the victim user). The attacker can perform actions such as session hijacking, defacement, or redirection to malicious sites. The advisory explicitly states there is no impact to the confidentiality, integrity, or availability of the affected device itself, nor any loss of availability in subsequent systems [1].

Mitigation

Moxa has released a security advisory (MPSA-257421) with details on affected products and firmware updates. Users are advised to evaluate their environment and apply the recommended updates to remediate the vulnerability [1].