CVE-2025-6950
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A use of hard-coded credentials vulnerability was identified in Moxa devices, which use a hard-coded secret key to sign JWTs. An unauthenticated attacker can forge valid tokens, bypass authentication, and impersonate any user.
Risk Assessment
Exploitation can result in complete system compromise, unauthorized access, data theft, and full administrative control.
Recommendation
Update Moxa firmware to a fixed version and rotate the hard-coded signing key.
Other vulnerabilities in Moxa network security appliances and routers
See all- CVE-2025-6949Critical
An authorization flaw in the API of Moxa network security appliances and routers allows an authenticated low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. This could lead to full administrative control and account impersonation.
- CVE-2025-6893Critical
A broken access control flaw was identified in the /api/v1/setting/data endpoint of Moxa devices. A low-privileged authenticated user can call the API without required permissions to access or modify system configuration data.
Original NVD description (English source)
An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for authentication. This insecure implementation allows an unauthenticated attacker to forge valid tokens, thereby bypassing authentication controls and impersonating any user. Exploitation of this vulnerability can result in complete system compromise, enabling unauthorized access, data theft, and full administrative control over the affected device. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS