CVE-2025-6894

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization logic of the affected device allows an authenticated, low-privileged user to execute the administrative `ping` function, which is restricted to higher-privileged roles. This vulnerability enables the user to perform internal network reconnaissance, potentially discovering internal hosts or services that would otherwise be inaccessible. Repeated exploitation could lead to minor resource consumption. While the overall impact is limited, it may result in some loss of confidentiality and availability on the affected device. There is no impact on the integrity of the device, and the vulnerability does not affect any subsequent systems.

• CWE-250

• https://www.moxa.com/en/support/product-support/security-advisory/mpsa-258121-cve-2025-6892,-cve-2025-6893,-cve-2025-6894,-cve-2025-6949,-cve-2025-6950-multiple-vulnerabilities-in-netwo

Published

Oct 17, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68934Discourse is an open source discussion platform. In versions…6.5
• CVE-2025-68935ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field f…6.1
• CVE-2025-68936ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme …6.1
• CVE-2025-68937Forgejo before 13.0.2 allows attackers to write to unintende…9.5
• CVE-2025-68938Gitea before 1.25.2 mishandles authorization for deletion of…5.3
• CVE-2025-68939Gitea before 1.23.0 allows attackers to add attachments with…5.3
• CVE-2025-68940In Gitea before 1.22.5, branch deletion permissions are not …5.3
• CVE-2025-68941Gitea before 1.22.3 mishandles access to a private resource …5.3
• CVE-2025-68942Gitea before 1.22.2 allows XSS because the search input box …5.4
• CVE-2025-68943Gitea before 1.21.8 inadvertently discloses users' login tim…5.3
• CVE-2025-68944Gitea before 1.22.2 sometimes mishandles the propagation of …5.3
• CVE-2025-68945In Gitea before 1.21.2, an anonymous user can visit a privat…5.3