Vulnerability · Published Apr 2, 2025 · Assigned by Moxa

CVE-2025-0415Command Injection in NTP Setting

Critical 9.2

In plain English

A critical-severity OS command injection in EDF-G1002-BP Series from Moxa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.5%top 53.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for downstream systems that rely on its network services.

Affected products (as reported)

Vendor	Product	Versions
Moxa	EDF-G1002-BP Series	1.0 – through 3.14
Moxa	EDR-810 Series	1.0 – through 5.12.39
Moxa	EDR-8010 Series	1.0 – through 3.14
Moxa	EDR-G9004 Series	1.0 – through 3.14
Moxa	EDR-G9010 Series	1.0 – through 3.14
Moxa	OnCell G4302-LTE4 Series	1.0 – through 3.14
Moxa	TN-4900 Series	1.0 – through 3.14
Moxa	NAT-102 Series	1.0 – through 3.15

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-259491-cve-2025-0415-command-injection-leading-to-denial-of-service-(dos) vendor-advisory