CVE-2025-6949

Katalog CVE

CVSS 9.3 · Critical EPSS 0,52%

Kerentanan Execution with Unnecessary Privileges. Skor CVSS 4.0 9.3 (Critical) menurut moxa.com.

Deskripsi (NVD)

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in the API allows an authenticated, low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. In certain scenarios, this vulnerability could allow an attacker to gain full administrative control over the affected device, leading to potential account impersonation. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.

Rincian

Terbit di NVD

17 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

9.3 (Critical), sumber moxa.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-250: Execution with Unnecessary Privileges

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.moxa.com/en/support/product-support/security-advisory/mpsa-258121-cve-2025-6892,-cve-2025-6893,-cv...