Moxa OnCell G4302-LTE4 unnecessary privileges

Summaryinfo

A vulnerability was found in Moxa EDR-G9010, EDR-8010, EDF-G1002-BP, TN-4900, NAT-102, NAT-108 and OnCell G4302-LTE4. It has been rated as very critical. The affected element is an unknown function. The manipulation leads to unnecessary privileges. This vulnerability is referenced as CVE-2025-6949. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Moxa EDR-G9010, EDR-8010, EDF-G1002-BP, TN-4900, NAT-102, NAT-108 and OnCell G4302-LTE4. It has been rated as very critical. This issue affects an unknown function. The manipulation with an unknown input leads to a unnecessary privileges vulnerability. Using CWE to declare the problem leads to CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in the API allows an authenticated, low-privileged user to create a new administrator account, including accounts with usernames identical to existing users. In certain scenarios, this vulnerability could allow an attacker to gain full administrative control over the affected device, leading to potential account impersonation. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.

It is possible to read the advisory at moxa.com. The identification of this vulnerability is CVE-2025-6949 since 07/01/2025. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/17/2025). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-34857). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• Moxa

Name

• EDF-G1002-BP
• EDR-8010
• EDR-G9010
• NAT-102
• NAT-108
• OnCell G4302-LTE4
• TN-4900

License

• commercial

Website

• Vendor: https://www.moxa.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion