Critical Moxa Flaw (CVE-2025-6950, CVSS 9.9) Allows Unauthenticated Admin Takeover via Hard-Coded JWT Secret

According to Moxa, the Critical vulnerability CVE-2025-6950 carries a CVSS of 9.9 and stems from a hard-coded secret key used to sign JSON Web Tokens for authentication, enabling an unauthenticated attacker to forge valid tokens, bypass authentication controls, and impersonate any user to gain full administrative control over affected devices.

The flaw, one of five in advisories covering multiple product series (EDR-G9010, EDR-8010, EDF-G1002-BP, TN-4900, NAT-102, NAT-108, and OnCell G4302-LTE4), could let attackers access data, alter configurations, or disable security features. Moxa confirms that exploitation would grant full administrative control over the device, with potential data theft and configuration changes.

The company recommends updating to firmware version 3.21 or later for the affected series, and provides patch details, including contacting Technical Support for the OnCell G4302-LTE4 Series.