CVE-2025-6892
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Moxa network security appliances and routers have an incorrect authorization vulnerability in the API authentication mechanism. After a legitimate user logs in, the system fails to properly validate session context or privilege boundaries, allowing access to protected API endpoints and privileged operations.
Risk Assessment
An attacker can leverage the flaw to perform unauthorized privileged operations, impacting the confidentiality, integrity, and availability of the device.
Recommendation
Apply vendor updates that improve session and privilege validation in the API as recommended by Moxa. Restrict administrative access to trusted networks.
Other vulnerabilities in Moxa network security appliances and routers
See all- CVE-2025-6950Critical
A use of hard-coded credentials vulnerability was identified in Moxa devices, which use a hard-coded secret key to sign JWTs. An unauthenticated attacker can forge valid tokens, bypass authentication, and impersonate any user.
- CVE-2025-6949Critical
An authorization flaw in the API of Moxa network security appliances and routers allows an authenticated low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. This could lead to full administrative control and account impersonation.
- CVE-2025-6893Critical
A broken access control flaw was identified in the /api/v1/setting/data endpoint of Moxa devices. A low-privileged authenticated user can call the API without required permissions to access or modify system configuration data.
Original NVD description (English source)
An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allows unauthorized access to protected API endpoints, including those intended for administrative functions. This vulnerability can be exploited after a legitimate user has logged in, as the system fails to properly validate session context or privilege boundaries. An attacker may leverage this flaw to perform unauthorized privileged operations. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS