CVE-2025-6949: Moxa Network Security Appliances and Routers: Unnecessary Privileges in API Allows Admin Account Creation
Moxa network security appliances and routers contain an API authorization flaw (CWE-250) that lets an authenticated, low-privileged user create administrator accounts, including accounts with usernames identical to existing users. Moxa rates it 9.3 (critical) under CVSS 4.0, and the record shows no KEV listing or confirmed exploitation in the sources consulted. Check the Moxa advisory for affected versions and fixes, since the record does not provide them.
Overview
CVE-2025-6949 affects Moxa network security appliances and routers and is classified as CWE-250, Execution with Unnecessary Privileges. According to the record, an authenticated user with low privileges can abuse an authorization flaw in the API to create a new administrator account. The vendor's Moxa security advisory is the primary reference listed.
Impact
- The CNA states that successful exploitation can severely affect the confidentiality, integrity and availability of the affected device itself.
- A low-privileged account could potentially gain full administrative control of the device, which may enable account impersonation.
- The CNA states there is no loss of confidentiality or integrity within subsequent systems.
- Moxa's CVSS 4.0 base score is 9.3, rated critical.
Affected products and versions
The record does not list affected products or versions in its structured fields. The description refers to Moxa network security appliances and routers in general, so affected version ranges are unknown from the available data. The Moxa advisory is the authoritative source for the affected model and version list.
Exploitation status
The record shows CVE-2025-6949 is not listed in CISA's Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed. No confirmed exploitation appears in the sources consulted. The record includes EPSS values (probability 0.00521, percentile 0.42671), which are a statistical estimate of exploitation likelihood and not evidence of activity.
Remediation and mitigation
- Review the Moxa advisory for vendor guidance and any firmware updates that apply to your models.
- Until a fix is verified, restrict access to the management API and limit management interfaces to trusted administrative networks.
- Apply the principle of least privilege to all accounts on affected devices and remove unneeded low-privileged accounts.
- Schedule updates through your normal change process and confirm the installed version after patching.
Detection guidance
- Review administrator account lists regularly for unexpected accounts or duplicate usernames.
- Audit logs for account creation events, especially those originating from non-administrative users.
- Monitor management API activity for access from unfamiliar sources or at unusual times.
Limitations of the available information
The record contains no affected version data, no fixed version data, and no advisory text. The only CVSS data is the CNA's CVSS 4.0 score, and no other scoring provider is recorded. The EPSS date in the record (2026-10-13) is later than the publication date (2025-10-17), so its timing should be treated with caution. Patch availability is unknown from the record.
Frequently asked questions
What is CVE-2025-6949?
It is a CWE-250 authorization flaw in the API of Moxa network security appliances and routers. An authenticated low-privileged user can create a new administrator account.
How severe is it according to the record?
Moxa, as the CNA, assigns a CVSS 4.0 base score of 9.3, which is rated critical. The record does not include scores from other providers.
Is this vulnerability being actively exploited?
The record does not list it in CISA's KEV catalog, and no confirmed exploitation appears in the sources consulted.
Which versions are affected and is there a fix?
The record does not list affected or fixed versions. Check the Moxa security advisory referenced in the record for this information.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.