CVE-2025-6949

Summary

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in the API allows an authenticated, low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. In certain scenarios, this vulnerability could allow an attacker to gain full administrative control over the affected device, leading to potential account impersonation. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.

Affected Software

VendorProductVersion RangeStatus
MoxaEDR-G9010 Series1.0 <= 3.14affected
MoxaEDR-G9010 Series3.21unaffected
MoxaEDR-8010 Series1.0 <= 3.17affected
MoxaEDR-8010 Series3.21unaffected
MoxaEDF-G1002-BP Series1.0 <= 3.17affected
MoxaEDF-G1002-BP Series3.21unaffected
MoxaTN-4900 Series1.0 <= 3.14affected
MoxaTN-4900 Series3.21unaffected
MoxaNAT-102 Series1.0 <= 3.17affected
MoxaNAT-102 Series3.21unaffected
MoxaNAT-108 Series1.0 <= 3.16affected
MoxaNAT-108 Series3.21unaffected
MoxaOnCell G4302-LTE4 Series1.0 <= 3.13affected
MoxaOnCell G4302-LTE4 Series3.21.0unaffected

Weaknesses

  • CWE-250: CWE-250: Execution with Unnecessary Privileges

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References