Moxa network appliances CVE-2025-6894

Exploitation requires the attacker to already hold a valid, authenticated low-privileged user account on the Moxa device (PR:L), and the device must expose its management API over the network. The specific prerequisite is access to the administrative 'ping' API function, whose authorization check fails to enforce the intended higher-privilege role. Limiting factors: no anonymous/unauthenticated path exists, so a prior credential or foothold is mandatory; impact is confined to internal reconnaissance and minor resource use, with no integrity or subsequent-system effect; realistic value to an attacker depends on the device sitting at a boundary to otherwise-inaccessible internal segments.

This is a genuinely moderate, likely over-triaged issue rather than an urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reachability with low complexity but requires an existing authenticated low-privileged account (PR:L), which materially limits the attacker population to those who already have a foothold on the device. Impact is deliberately narrow: VC:L and VA:L with VI:N - only limited confidentiality (reconnaissance of internal hosts) and limited availability (minor resource consumption via repeated pings), no integrity impact, and no subsequent-system impact (SC/SI/SA:N). EPSS of 0.58% (47th percentile) signals low predicted exploitation probability, consistent with the absence of any CISA KEV listing and no public exploit code. The SSVC-style read is low urgency: not automatable in a damaging way, technical impact is partial at best, and exploitation status is unreported. Signals are mutually consistent - there is no conflict between the CVSS, EPSS, and KEV data. The main caveat is that details come solely from Moxa's own advisory; affected version ranges and fixed releases were not available in the provided reference snippet and should be confirmed against the Moxa MPSA advisory.

An attacker who has already obtained low-privileged credentials on a Moxa security appliance or router (for example a limited operator account) invokes the administrative 'ping' API endpoint that should be restricted to higher-privileged roles. By repeatedly pinging internal addresses, they enumerate live hosts and services on segments behind the device that are otherwise unreachable. No public exploit code has been identified at time of analysis.