Execution with Unnecessary Privileges in Moxa Network Security Appliances and Routers

CVE-2025-6894

What is CVE-2025-6894?

A vulnerability affecting Moxa’s network security appliances and routers allows authenticated low-privileged users to execute the administrative 'ping' function, which is typically reserved for higher-privileged roles. This flaw in API authorization logic can enable unauthorized internal network reconnaissance, exposing hosts or services that are otherwise protected. Continuous exploitation may lead to minor resource consumption, causing limited impacts on confidentiality and availability. However, it does not compromise the integrity of the device, nor does it affect any other connected systems.

References