MOXA TN-4900 Series

• CVE-2025-6950 Critical 9.9 An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for 0.6%
• CVE-2025-6949 Critical 9.3 An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in the API allows an authenticated, low-priv 0.5%
• CVE-2025-6894 Medium 5.3 An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization logic of the affected device allows an aut 0.6%
• CVE-2025-6893 Critical 9.3 An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in broken access control has been identified in the /api/v1/setting 0.7%
• CVE-2025-6892 High 8.7 An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allows unauthorized access to protected API e 0.5%
• CVE-2025-0676 High 8.6 Commend Injection Leading to Privilege Escalation 1.0%
• CVE-2025-0415 Critical 9.2 Command Injection in NTP Setting 0.5%
• CVE-2024-9140 Critical 9.8 Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS command injection due to improperly restr 1.8%
• CVE-2024-9138 High 7.2 Privilege Escalation in Cellular Router, Secure Router, and Network Security Appliances 1.1%
• CVE-2024-9139 High 7.2 OS Command Injection in Restricted Command 1.4%
• CVE-2024-9137 Critical 9.4 Moxa Service Missing Authentication for Critical Function 0.5%
• CVE-2023-34217 High 8.1 Second Order Command-injection Vulnerability in the Certificate-delete Function 0.4%
• CVE-2023-34216 High 8.1 Second Order Command-injection Vulnerability in the Key-delete Function 0.7%
• CVE-2023-34214 High 7.2 Second Order Command-injection Vulnerability in the Certificate-generation Function 0.4%
• CVE-2023-33239 High 8.8 Second Order Command-injection Vulnerability in the Key-generation Function 1.3%
• CVE-2023-33238 High 7.2 Command-injection Vulnerability in Certificate Management 0.8%