An out-of-bounds write vulnerability in the Moxa TN-4500B series allows unauthenticated attackers to crash the device through a buffer overflow, resulting in a critical denial of service.

This vulnerability involves an out-of-bounds write (CWE-787) triggered by improper validation of the username field length during the web login process. Because the attack vector is network-based and requires no authentication (PR:N), an unauthenticated attacker can remotely crash the authentication service.

The ability for an unauthenticated attacker to trigger a denial of service condition poses a significant risk to operational continuity, particularly for critical infrastructure relying on these Ethernet switches. Given the CVSS score of 8.8, this vulnerability is classified as high severity, as it can disrupt network connectivity and management capabilities across the affected environment, leading to unplanned downtime and administrative overhead to restore services.

Immediate Action: Update the firmware of all affected Moxa TN-4500B series switches to version 2.1 or later as specified in the vendor security advisory.

Proactive Monitoring: Monitor device logs for recurring authentication failures or sudden service crashes that may indicate an attempt to exploit the buffer overflow condition.

Compensating Controls: Restrict access to the device management web interface to trusted management networks or VPNs to limit exposure to potential attackers.

Public Exploit Available: No (exploit_available: false)

The high CVSS score reflects the ease of exploitation and the potential for significant service disruption. Administrators should verify the current firmware version of all deployed TN-4500B units and prioritize the upgrade to version 2.1 to eliminate the underlying buffer overflow risk. Immediate patching is strongly recommended to maintain network stability and security posture.