CVE-2025-6949
Full vulnerability record from the local CVENow database.
Description
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in the API allows an authenticated, low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. In certain scenarios, this vulnerability could allow an attacker to gain full administrative control over the affected device, leading to potential account impersonation. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.
Severity
CRITICAL
CVSS score
9.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2025-10-17 04:16:12.620000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-6949",
"sourceIdentifier": "[email protected]",
"published": "2025-10-17T04:16:12.620",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in the API allows an authenticated, low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. In certain scenarios, this vulnerability could allow an attacker to gain full administrative control over the affected device, leading to potential account impersonation. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems."
},
{
"lang": "es",
"value": "Una vulnerabilidad de ejecución con privilegios innecesarios ha sido identificada en los dispositivos de seguridad de red y routers de Moxa. Una falla crítica de autorización en la API permite a un usuario autenticado y con pocos privilegios crear una nueva cuenta de administrador, incluyendo cuentas con nombres de usuario idénticos a los de usuarios existentes. En ciertos escenarios, esta vulnerabilidad podría permitir a un atacante obtener control administrativo total sobre el dispositivo afectado, lo que lleva a una posible suplantación de cuenta. Si bien la explotación exitosa puede impactar severamente la confidencialidad, integridad y disponibilidad del propio dispositivo afectado, no hay pérdida de confidencialidad o integridad dentro de ningún sistema subsiguiente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Moxa",
"product": "EDR-G9010 Series",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0",
"lessThanOrEqual": "3.14",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.21",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "Moxa",
"product": "EDR-8010 Series",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0",
"lessThanOrEqual": "3.17",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.21",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "Moxa",
"product": "EDF-G1002-BP Series",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0",
"lessThanOrEqual": "3.17",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.21",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "Moxa",
"product": "TN-4900 Series",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0",
"lessThanOrEqual": "3.14",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.21",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "Moxa",
"product": "NAT-102 Series",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0",
"lessThanOrEqual": "3.17",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.21",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "Moxa",
"product": "NAT-108 Series",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0",
"lessThanOrEqual": "3.16",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.21",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "Moxa",
"product": "OnCell G4302-LTE4 Series",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0",
"lessThanOrEqual": "3.13",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.21.0",
"versionType": "custom",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-17T14:27:10.599179Z",
"id": "CVE-2025-6949",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-250"
}
]
}
],
"references": [
{
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-258121-cve-2025-6892,-cve-2025-6893,-cve-2025-6894,-cve-2025-6949,-cve-2025-6950-multiple-vulnerabilities-in-netwo",
"source": "[email protected]"
}
]
}