CVE-2025-0415 CRITICAL

CVE-2025-0415: Command Injection in NTP Setting

Vendor Moxa
Product EDF-G1002-BP Series
Weakness CWE-78
Published April 2, 2025
Last update April 3, 2025

CVSS base score

9.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H

What the vulnerability does

01Description

A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for downstream systems that rely on its network services.

Key dates

02Disclosure timeline

April 2, 2025 CVE published
April 3, 2025 Record updated

Related vulnerabilities

04Related CVE