Loading story…
A critical security vulnerability, tracked as CVE-2025-6950, has been identified in Moxa network security appliances and routers, allowing unauthenticated attackers to gain administrative access via a hard-coded JWT secret. The flaw, which carries a CVSS score of 9.9, stems from the use of a hard-coded secret key for signing JSON Web Tokens (JWT) used in the authentication process. This insecure implementation enables attackers to forge valid JWTs without any prior authentication, effectively bypassing all access controls. As a result, an attacker can impersonate any user, including administrators, and obtain full control over the affected device. Exploitation of this vulnerability can lead to unauthorized access, data theft, and complete system compromise. The vulnerability is remotely exploitable, significantly increasing the risk to organizations deploying these devices in critical network environments. According to the available reports, there is no evidence that exploitation of this flaw leads to loss of confidentiality or integrity in systems beyond the affected device itself. The vulnerability was disclosed by Moxa’s Product Security Incident Response Team (PSIRT) and has been publicly documented in multiple security advisories. Security researchers emphasize the severity of the issue due to the ease of exploitation and the potential impact on industrial and enterprise networks. The affected products include a range of Moxa network security appliances and routers, though specific model versions have not been detailed in the public advisories. Organizations using these devices are urged to review their deployments and apply any available patches or mitigations as soon as possible. The vulnerability was published and last updated on October 17, 2025, highlighting the need for immediate attention from network administrators. The flaw is distinct from other recent privilege escalation vulnerabilities in Moxa products, as it allows for unauthenticated, rather than authenticated, administrative takeover. Security experts recommend monitoring for signs of unauthorized access and reviewing authentication logs for suspicious activity. The use of hard-coded credentials is a well-known security anti-pattern, and this incident underscores the importance of secure key management in authentication systems. Moxa has been notified and is expected to release further guidance and remediation steps. Until patches are available, organizations should consider network segmentation and access restrictions to limit exposure. The incident has raised concerns about the security of industrial control systems and the potential for similar flaws in other embedded network devices. The vulnerability’s critical rating and remote exploitability make it a high-priority issue for all organizations relying on Moxa network security appliances.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Alongside the disclosure, Moxa referenced a security advisory with remediation guidance, including applying vendor updates, removing hard-coded credentials, implementing secure JWT signing, and re-authenticating users. The issue was rated Critical with a CVSS v4.0 score of 9.9.
Moxa PSIRT disclosed CVE-2025-6950, a critical vulnerability in Moxa network security appliances and routers caused by a hard-coded JWT signing secret. The flaw allows unauthenticated remote attackers to forge valid tokens, bypass authentication, impersonate users including administrators, and potentially fully compromise affected devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcehelpnetsecurity.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Moxa disclosed and patched **CVE-2024-12297**, a critical authorization flaw in multiple industrial Ethernet switch lines that can let a remote, unauthenticated attacker bypass authentication and access device functions. The vulnerability stems from weaknesses in frontend authorization logic and client-side versus back-end verification, allowing brute-force credential guessing and potential **MD5 collision** attacks to forge authentication hashes. Moxa rated the issue **CVSS 9.2** and said exploitation could expose sensitive configurations or disrupt services on affected switches. The flaw initially affected the **EDS-508A Series** on firmware `3.11` and earlier, and advisories later expanded coverage to additional **EDS**, **SDS**, and **PT series** models, including PT-508, PT-510, PT-7528, PT-7728, PT-7828, PT-G503, PT-G510, PT-G7728, and PT-G7828 below specified fixed versions. Moxa issued firmware updates for most impacted products and told some EDS-508A customers to obtain patches through technical support. The company also urged operators to minimize Internet exposure, restrict SSH and management access to trusted networks, apply least privilege and MFA where possible, and strengthen logging, IDS/IPS, and network monitoring around affected operational technology environments.
Jul 24, 2026
CERT-FR published two advisories covering vulnerabilities in **Moxa** products, warning that the flaws could let attackers **escalate privileges** and undermine core security controls. One notice said successful exploitation could also affect **data confidentiality** and **data integrity**, raising concern for industrial and networked environments where Moxa equipment is commonly deployed. A separate CERT-FR notice reported another Moxa vulnerability that could allow an attacker to **bypass the security policy**. The advisories did not provide further technical details in the referenced content, including affected models, `CVE` identifiers, or specific remediation steps, leaving organizations to monitor vendor and national CERT guidance closely for product impact and patch information.
Jun 29, 2026
Moxa has disclosed multiple vulnerabilities in its NPort serial device server lines, including **CVE-2026-10825**, **CVE-2026-10828**, and **CVE-2026-10829**, affecting the **NPort 6000-G2 Series**, **NPort W2150A-W4/W2250A-W4 Series**, and older **NPort W2150A/W2250A Series** devices. The most severe issue, `CVE-2026-10829`, is a stack-based buffer overflow in the web interface's **"Server location"** parameter that can lead to memory corruption and potentially **remote code execution with root privileges**. Moxa also reported `CVE-2026-10828`, a format string flaw in the **"alias"** parameter that may expose sensitive memory and help bypass ASLR, and `CVE-2026-10825`, an improper JSON input validation flaw in the WebSocket API that can be exploited by a low-privileged authenticated attacker to cause **denial of service** and unexpected device reboots.
Jun 29, 2026