Moxa network security appliances and routers vulnerabilities

A use of hard-coded credentials vulnerability was identified in Moxa devices, which use a hard-coded secret key to sign JWTs. An unauthenticated attacker can forge valid tokens, bypass authentication, and impersonate any user.

An authorization flaw in the API of Moxa network security appliances and routers allows an authenticated low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. This could lead to full administrative control and account impersonation.

A broken access control flaw was identified in the /api/v1/setting/data endpoint of Moxa devices. A low-privileged authenticated user can call the API without required permissions to access or modify system configuration data.

Moxa network security appliances and routers have an incorrect authorization vulnerability in the API authentication mechanism. After a legitimate user logs in, the system fails to properly validate session context or privilege boundaries, allowing access to protected API endpoints and privileged operations.