CVE-2025-6949
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
An authorization flaw in the API of Moxa network security appliances and routers allows an authenticated low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. This could lead to full administrative control and account impersonation.
Risk Assessment
A low-privileged attacker could gain full administrative control over the device, severely impacting the confidentiality, integrity, and availability of the device itself.
Recommendation
Update Moxa device firmware to a version containing the fix. Restrict API access and monitor administrative account creation.
Other vulnerabilities in Moxa network security appliances and routers
See all- CVE-2025-6950Critical
A use of hard-coded credentials vulnerability was identified in Moxa devices, which use a hard-coded secret key to sign JWTs. An unauthenticated attacker can forge valid tokens, bypass authentication, and impersonate any user.
- CVE-2025-6893Critical
A broken access control flaw was identified in the /api/v1/setting/data endpoint of Moxa devices. A low-privileged authenticated user can call the API without required permissions to access or modify system configuration data.
Original NVD description (English source)
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in the API allows an authenticated, low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. In certain scenarios, this vulnerability could allow an attacker to gain full administrative control over the affected device, leading to potential account impersonation. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS