CVE-2025-6950

An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for authentication. This insecure implementation allows an unauthenticated attacker to forge valid tokens, thereby bypassing authentication controls and impersonating any user. Exploitation of this vulnerability can result in complete system compromise, enabling unauthorized access, data theft, and full administrative control over the affected device. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.

• CWE-798

• https://www.moxa.com/en/support/product-support/security-advisory/mpsa-258121-cve-2025-6892,-cve-2025-6893,-cve-2025-6894,-cve-2025-6949,-cve-2025-6950-multiple-vulnerabilities-in-netwo

Published

Oct 17, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69443Remote Code Execution in coleam00 Archon 0.1.0. A crafted HT…6.3
• CVE-2025-6945GitLab has remediated an issue in GitLab EE affecting all ve…3.5
• CVE-2025-6946A stored cross-site scripting (XSS) vulnerability exists in …4.8
• CVE-2025-6947A stored cross-site scripting (XSS) vulnerability exists in …4.8
• CVE-2025-6948An issue has been discovered in GitLab CE/EE affecting all v…8
• CVE-2025-6949An Execution with Unnecessary Privileges vulnerability has b…9.3
• CVE-2025-6951A vulnerability classified as problematic was found in SAFEC…4.3
• CVE-2025-69515An issue in JXL 9 Inch Car Android Double Din Player Android…9.1
• CVE-2025-69516A Server-Side Template Injection (SSTI) vulnerability in the…8.8
• CVE-2025-69517An HTML injection vulnerability in Amidaware Inc Tactical RM…8.8
• CVE-2025-6952A vulnerability, which was classified as problematic, has be…4.8
• CVE-2025-6953A vulnerability, which was classified as critical, was found…8.8