Moxa network appliances CVE-2025-6949

Requires a valid authenticated low-privileged user account on the affected Moxa network security appliance or router (CVSS PR:L); it is not exploitable by a fully unauthenticated attacker. The specific trigger is an authorization flaw in the device management API's account-creation function, which fails to restrict account/role creation to administrators, allowing a low-privileged user to create administrator accounts - including ones whose usernames duplicate existing users, enabling impersonation. Limiting factors: attacker must first possess or obtain low-privileged credentials and must be able to reach the management API over the network; no user interaction is needed (UI:N). Impact is confined to the affected device itself - the vendor states there is no confidentiality or integrity loss on subsequent/downstream systems.

This is a genuine high-priority issue for the specific device class it affects, though the signals are mixed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high confidentiality, integrity and availability impact drives the 9.3 score, and the attack is network-reachable with low complexity. The key tempering factor is PR:L - exploitation requires an existing authenticated low-privileged account, so this is a privilege-escalation path rather than a pre-auth remote compromise. EPSS is low at 0.52% (43rd percentile), and the CVE is NOT in CISA KEV and has no public exploit identified at time of analysis; these lower-urgency signals are consistent with each other and suggest no widespread automated exploitation yet. The low EPSS is not surprising given the authentication prerequisite. Net: for operators of Moxa security appliances/routers this warrants prompt patching because the outcome (full admin takeover) is severe and complexity is low, but the need for a valid low-privileged credential makes mass, unauthenticated exploitation unlikely. No conflicting data between the CVSS vector and the description - both agree on network vector plus authenticated low-privileged access.

An attacker who already holds a valid low-privileged account on a Moxa network security appliance (e.g. a limited operator login, or credentials obtained via phishing/reuse) sends a crafted API request that abuses the broken authorization check to create a new administrator account - potentially even reusing an existing user's name to impersonate them. With admin rights the attacker reconfigures the device, intercepts or reroutes traffic, and disables protections. No public exploit code is identified at time of analysis, so exploitation currently requires original development.