CVE Intelligence
Analysis AI-assisted

CVE-2025-6893: Moxa network security appliances and routers: unnecessary privileges via broken access control

Moxa has disclosed CVE-2025-6893, a broken access control flaw classified as CWE-250 (Execution with Unnecessary Privileges) in its network security appliances and routers. A low-privileged authenticated user may be able to access or modify system configuration data, which can lead to privilege escalation. The CNA rates it CVSS 4.0 9.3, and the CISA KEV catalog does not list it in the data consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Moxa's PSIRT published advisory MPSA-258121, which covers CVE-2025-6893 along with other issues in its network security appliances and routers. The weakness is classified as CWE-250 and is described as broken access control on an API endpoint that does not enforce the required permissions.

Impact

  • A low-privileged authenticated user may reach configuration functions without the required permissions.
  • Successful exploitation may lead to privilege escalation and unauthorized access to or modification of sensitive system settings.
  • The record describes the overall impact as high, with no loss of confidentiality or integrity in subsequent systems.
  • The CNA's CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H and the score is 9.3.

Affected products and versions

  • The record names Moxa network security appliances and routers in general. No affected product models or firmware versions are listed in the data consulted.
  • No fixed versions are listed in the record. The Moxa security advisory is the primary source to check for the authoritative list.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the data consulted. No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability in the record is 0.00656, with a percentile of 0.50065.

Remediation and mitigation

  • Inventory all Moxa appliances and routers in your environment and compare them with the vendor advisory for affected models and fixed firmware.
  • Apply vendor-provided firmware updates for your models once they are confirmed as fixed.
  • Until patching is complete, restrict access to management interfaces to trusted administrators and trusted networks.
  • Review user accounts and apply least privilege, removing accounts that do not need access.

Detection guidance

  • Review device logs for sessions from low-privileged accounts that access configuration functions or make unexpected configuration changes.
  • Alert on unexpected changes to system settings and correlate them with approved change records.
  • Monitor management-plane access for unusual accounts or access times.

Limitations of the available information

  • The record does not list affected or fixed versions, and no NVD CVSS score is shown; only the CNA score of 9.3 is present.
  • The EPSS date in the record (2026-10-13) is later than the publication date, so the EPSS values should be treated as reported without further validation.
  • Behavior of the vulnerable endpoint beyond the description in the record is not available.

Frequently asked questions

What is CVE-2025-6893?

It is a broken access control vulnerability (CWE-250) in Moxa network security appliances and routers. A low-privileged authenticated user may access or modify system configuration data.

Is this CVE known to be actively exploited?

The CISA KEV catalog does not list it in the data consulted, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.