CVE-2025-6950

published 2025-10-17

CVE-2025-6950: An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret…

Priority P2 70 critical 9.9 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC N SI N SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for authentication. This insecure implementation allows an unauthenticated attacker to forge valid tokens, thereby bypassing authentication controls and impersonating any user. Exploitation of this vulnerability can result in complete system compromise, enabling unauthorized access, data theft, and full administrative control over the affected device. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
moxa	edf-g1002-bp_series	1.0 – 3.17	—
moxa	edr-8010_series	1.0 – 3.17	—
moxa	edr-g9010_series	1.0 – 3.14	—
moxa	nat-102_series	1.0 – 3.17	—
moxa	nat-108_series	1.0 – 3.16	—
moxa	oncell_g4302-lte4_series	1.0 – 3.13	—
moxa	tn-4900_series	1.0 – 3.14	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-798