High severity · published Apr 2, 2025
CVE-2025-0676
Commend Injection Leading to Privilege Escalation
8.6
CVSS
1%
EPSS
No
On KEV
Description
This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input validation to inject and execute systems commands. Successful exploitation could result in privilege escalation, allowing the attacker to gain root shell access and maintain persistent control over the device, potentially disrupting network services and affecting the availability of downstream systems that rely on its connectivity.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
EDF-G1002-BP Series · Moxa
1.0 through 3.14 · source: vendor
ES
EDR-8010 Series · Moxa
1.0 through 3.14 · source: vendor
ES
EDR-810 Series · Moxa
1.0 through 5.12.39 · source: vendor
ES
EDR-G9004 Series · Moxa
1.0 through 3.14 · source: vendor
ES
EDR-G9010 Series · Moxa
1.0 through 3.14 · source: vendor
NS
NAT-102 Series · Moxa
1.0 through 3.15 · source: vendor
OG
OnCell G4302-LTE4 Series · Moxa
1.0 through 3.14 · source: vendor
TS
TN-4900 Series · Moxa
1.0 through 3.14 · source: vendor
Affected product
ES
EDF-G1002-BP Series
Moxa
More from EDF-G1002-BP Series
9.9
CVE-2025-6950
An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers
9.8
CVE-2024-9140
Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140
9.3
CVE-2025-6949
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers
9.3
CVE-2025-6893
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers
9.2
CVE-2025-0415
Command Injection in NTP Setting