CVE-2025-1680

An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected device’s web service. This vulnerability is classified as Host Header Injection, where invalid Host headers can manipulate to redirect users, forge links, or phishing attacks. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of confidentiality, integrity, and availability within any subsequent systems.

Scoring

Severity

NONE

CVSS base score

0

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.17%

CWE

CWE-349

Published

2025-10-23

Last modified

2026-03-13

Affected products

• Moxa TN-4500A Series
• Moxa TN-4500A Series
• Moxa TN-5500A Series
• Moxa TN-5500A Series
• Moxa TN-G4500 Series
• Moxa TN-G4500 Series
• Moxa TN-G6500 Series
• Moxa TN-G6500 Series

Weakness type

• CWE-349

Related vulnerabilities

• CVE-2026-15387 — Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
• CVE-2026-54625 — django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
• CVE-2026-50252 — Possible cache poisoning attack by mapping source port population per thread
• CVE-2026-41120 — Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous...
• CVE-2026-46342 — Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
• CVE-2026-45602 — Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability
• CVE-2026-42960 — Possible cache poisoning via promiscuous records for the authority section
• CVE-2026-44572 — Next.js: Middleware / Proxy redirects can be cache-poisoned

Markdown version · Browse all CVEs