CVE-2025-6950

Published Oct 17, 2025

Last updated 5 months ago

CVSS critical 9.9
Jwt

Overview

Description
An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for authentication. This insecure implementation allows an unauthenticated attacker to forge valid tokens, thereby bypassing authentication controls and impersonating any user. Exploitation of this vulnerability can result in complete system compromise, enabling unauthorized access, data theft, and full administrative control over the affected device. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.
Source
psirt@moxa.com
NVD status
Awaiting Analysis

Risk scores

CVSS 4.0

Type
Secondary
Base score
9.9
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
CRITICAL

Weaknesses

psirt@moxa.com
CWE-798

Social media

Hype score
Not currently trending

  1. #VulnerabilityReport #AuthenticationBypass Critical Moxa Flaw (CVE-2025-6950, CVSS 9.9) Allows Unauthenticated Admin Takeover via Hard-Coded JWT Secret https://t.co/W5ex0Is3gO

    @Komodosec

    25 Nov 2025

    14 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Warning: Multiple critical vulnerabilities in #Moxa Inc. #ICS network appliances and routers (CVE-2025-6892, CVE-2025-6893, CVE-2025-6894, CVE-2025-6949, CVE-2025-6950), including hard-coded credentials and unauthorized admin account creation. https://t.co/zrwhdViCtE #Patch

    @CCBalert

    21 Oct 2025

    56 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  3. 🔴Moxa Industrial Devices: Hard-Coded JWT Credentials (CVE-2025-6950) 🔴 Moxa fixed 5 critical vulnerabilities in industrial routers/firewalls including unauthenticated RCE. CVE-2025-6950 stems from hard-coded JWT signing secrets. Attackers forge valid tokens, bypass

    @the_c_protocol

    21 Oct 2025

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Hard-coded credentials found in #Moxa #industrial security appliances, routers (#CVE-2025-6950) https://t.co/sTxwAk5oA7

    @ScyScan

    20 Oct 2025

    28 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. Moxa patched five critical flaws in its industrial routers, including a CVE-2025-6950 (CVSS 9.9) bug where hard-coded JWT credentials allow unauthenticated attackers to impersonate any user. Update to v3.21. #Moxa #ICSsecurity #CVE #CriticalPatch https://t.co/I9TV9UBrIj

    @the_yellow_fall

    20 Oct 2025

    379 Impressions

    5 Retweets

    6 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  6. 🚨 CRITICAL: CVE-2025-6950 hits Moxa EDR-G9010 Series (v1.0). Hard-coded JWT keys enable full system takeover—no auth needed! Patch pending; restrict access & monitor closely. https://t.co/57WxVTg0SZ #OffSeq #I... https://t.co/cvICmEx03S

    @offseq

    17 Oct 2025

    56 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-6950 Hard-Coded JWT Signing Key Vulnerability in Moxa Network Security Appliances https://t.co/PrKF8ugMRc

    @VulmonFeeds

    17 Oct 2025

    71 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  8. CVE-2025-6950 An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign… https://t.co/JxAsrQ01F8

    @CVEnew

    17 Oct 2025

    352 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with `alg: "none"` to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected `RS256` algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with `jwks-rsa` which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.•CVE-2026-27804
  2. Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.  The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.•CVE-2026-23552
  3. OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies). This vulnerability is fixed in 1.11.8.•CVE-2026-26010
  4. A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.•CVE-2026-1486
  5. Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.•CVE-2026-23518

References

Sources include official advisories and independent security research.