CVE-2025-6950: Moxa network security appliances and routers: hard-coded JWT signing key
CVE-2025-6950 affects Moxa network security appliances and routers, which use a hard-coded secret key to sign JSON Web Tokens used for authentication. The CNA rated it critical with a CVSS 4.0 base score of 9.9, and an unauthenticated attacker could forge tokens to impersonate any user. The CVE is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2025-6950 is a hard-coded credentials weakness (CWE-798) in Moxa network security appliances and routers. The affected products sign JSON Web Tokens used for authentication with a secret key embedded in the product, which makes token forgery possible. The record was published on 2025-10-17 and points to a Moxa security advisory, MPSA-258121, which covers several related vulnerabilities.
Impact
An unauthenticated attacker could forge valid tokens, bypass authentication and impersonate any user. The record describes possible outcomes including unauthorized access, data theft and full administrative control of the affected device. The impact is described as limited to the device itself, with no loss of confidentiality or integrity in subsequent systems. The CNA rated the issue critical with a CVSS 4.0 base score of 9.9.
Affected products and versions
The record does not list affected product models, firmware versions or fixed versions. The affected product families are described as Moxa network security appliances and routers. Consult the Moxa advisory for the authoritative list of models and versions.
- Product families named in the record: Moxa network security appliances and routers.
- Specific affected models and versions: unknown from the sources consulted.
- Fixed versions: unknown from the sources consulted.
Exploitation status
The record shows the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. This reflects the available data only and does not establish that exploitation has not occurred.
Remediation and mitigation
- Inventory all Moxa appliances and routers and record their models and firmware versions.
- Compare the inventory with the Moxa advisory and apply the vendor-provided update for each affected model as soon as it is available.
- Because the signing key is embedded in the product, a vendor firmware fix is the expected remediation. Confirm with the vendor whether the fix also invalidates tokens issued before the update.
- Until patching is complete, restrict management interfaces to trusted administrative networks and do not expose them directly to the internet.
- Limit administrative roles to the smallest practical set of users.
Detection guidance
- Review authentication logs for administrative sessions from unexpected sources or without a matching legitimate login.
- Watch for unexpected configuration changes, new accounts or unusual administrative activity on the devices.
- Forward device logs to a central system so that authentication events can be correlated across the environment.
Limitations of the available information
The record does not include affected version ranges, fixed versions, vendor workaround details or exploitation telemetry beyond the KEV status. The EPSS data in the record is a probability estimate and does not confirm exploitation. The Moxa advisory is the primary source for product-specific guidance, and this analysis does not replace it.
Frequently asked questions
Is CVE-2025-6950 being actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. Monitor the Moxa advisory and CISA updates for changes.
What should administrators do now?
Inventory affected Moxa devices, compare them with the vendor advisory, apply vendor firmware updates when available for each model, and restrict management interfaces to trusted networks in the meantime.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.