Moxa MXsecurity CVE-2025-9315

Exploitation requires network reachability to the MXsecurity management instance's REST API, specifically the /api/v1/devices/register endpoint, and the ability to send a crafted JSON payload that manipulates dynamically-determined object attributes (mass-assignment style, CWE-915). No authentication is required (PR:N), so default deployments that expose this API are reachable by unauthenticated remote attackers. LIMITING FACTORS: the CVSS High attack complexity (AC:H) indicates the attacker must meet a specific, non-trivial condition for the crafted payload to succeed; impact is confined to a limited integrity change (registering unauthorized devices) with no confidentiality or availability effect; and risk is sharply reduced where the management interface/API is not exposed to untrusted networks, which is normal hardening practice for OT management platforms.

This is a genuinely moderate-risk issue (CVSS 4.0 base 6.3, MEDIUM) rather than a top-priority emergency, and the signals are notably consistent with each other. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) describes a network-reachable, unauthenticated flaw, but with high attack complexity (AC:H) and impact limited to vulnerable-system integrity only (VI:L; VC:N, VA:N, and all subsequent-system metrics N). In plain terms, an attacker can make a constrained, unauthorized modification (registering rogue devices) but cannot read data, cause outages, or pivot into other systems per the vendor's own scoring. EPSS reinforces the low-urgency reading: 0.46% probability at the 38th percentile indicates exploitation is not currently predicted to be widespread. The vulnerability is NOT in CISA KEV and has no public proof-of-concept identified, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AC:H rating is the main point warranting scrutiny - it implies some non-trivial condition or crafted-payload effort beyond a trivial single request, yet the description frames the attack simply as sending a crafted JSON payload to a registration endpoint; defenders should verify with Moxa why complexity was rated High, as this materially affects real-world exploitability. Net assessment: patch in due course, prioritize for exposed/OT-adjacent deployments, but this does not carry the hallmarks (confidentiality/availability impact, KEV, high EPSS, public PoC) of a drop-everything issue.

An attacker with network access to an exposed MXsecurity management instance sends a specially crafted JSON payload to the /api/v1/devices/register endpoint, which improperly trusts client-controlled object attributes (CWE-915) and registers an unauthorized device without any authentication. No public exploit code is identified at this time, and the CVSS High attack complexity suggests the payload must satisfy specific conditions to succeed. The practical outcome is a limited integrity impact - unauthorized devices appear in the management inventory - with no data disclosure or service disruption.