CVE-2025-1680

The record

An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected device’s web service. This vulnerability is classified as Host Header Injection, where invalid Host headers can manipulate to redirect users, forge links, or phishing attacks. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of confidentiality, integrity, and availability within any subsequent systems.

Affected packages

Related vulnerabilities

• CVE-2026-19033 For a secondary zone with transfers restricted by TSIG, `named` may start to serve the… CWE-349
• CVE-2026-78301 A malformed zone may contain an NS or DNAME node above its origin, which `named` treats… CWE-349
• CVE-2026-74916 The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of… CWE-349
• CVE-2026-15387 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before… CWE-349
• CVE-2026-50252 In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized… CWE-349
• CVE-2026-41120 Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of… CWE-349
• CVE-2026-33612 A malicious authoritative server can send a crafted zone via the ZoneToCache function… CWE-349
• CVE-2026-46342 Nuxt is an open-source web development framework for Vue.js. CWE-349