Cyber Resilience

CVE-2025-6893

Critical

Published: 17 October 2025

Published
17 October 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0012 30.9th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-6893 is a critical-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Moxa (inferred from references). Its CVSS base score is 9.3 (Critical).

Operationally, ranked at the 30.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in broken access control has been identified in the /api/v1/setting/data endpoint of the affected device. This flaw allows a low-privileged authenticated user…

more

to call the API without the required permissions, thereby gaining the ability to access or modify system configuration data. Successful exploitation may lead to privilege escalation, allowing the attacker to access or modify sensitive system settings. While the overall impact is high, there is no loss of confidentiality or integrity within any subsequent systems.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Moxa
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-250

Policy promotes least privilege by defining necessary privileges and management commitment to them.

addresses: CWE-250

Supervision detects and allows removal of unnecessary privileges that enable execution with excess rights.

addresses: CWE-250

Reviewing accounts for compliance, disabling/removing unneeded accounts, and aligning with termination processes prevents execution with unnecessary privileges.

addresses: CWE-250

Separation of duties prevents any single user from holding all privileges needed to complete a critical task, directly reducing execution with unnecessary privileges.

addresses: CWE-250

Directly prevents execution with more privileges than needed for assigned tasks.

addresses: CWE-250

Role-based training on least privilege principles reduces the chance personnel assign or retain unnecessary privileges.

addresses: CWE-250

Analysis of audit records can identify execution with unnecessary privileges through unusual activity patterns.

addresses: CWE-250

Automatic termination after a defined period eliminates unnecessary privileges from persistent connections.

References