CVE-2025-9315: moxa mxsecurity series

Vulnerability summary

CVE-2025-9315 is a medium (CVSS 6.3) vulnerability in moxa mxsecurity series. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.6% of scored vulnerabilities.

Timeline

1. 10-12-2025
   PublishedVulnerability first disclosed.
2. 10-12-2025
   Last modifiedVulnerability information updated.

Description

An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identified in the MXsecurity Series. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted JSON payload to the device's registration endpoint /api/v1/devices/register, allowing the attacker to register unauthorized devices without authentication. Although exploiting this vulnerability has limited modification of data, there is no impact to the confidentiality and availability of the affected device, as well as no loss of confidentiality, integrity, and availability within any subsequent systems.

• CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.