PT-2025-50311 · Unknown · Mxsecurity Series

Leo Lin · Published 2025-12-10 · Updated 2025-12-10 · CVE-2025-9315

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MXsecurity Series (affected versions not specified)

Description An unauthenticated device registration issue exists due to Improperly Controlled Modification of Dynamically-Determined Object Attributes. An attacker can exploit this by sending a crafted JSON payload to the /api/v1/devices/register endpoint, enabling registration of unauthorized devices without authentication. The vulnerability allows for limited data modification, but does not impact the confidentiality or availability of the device or subsequent systems. The vulnerable parameter is the JSON payload sent to the API endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2025-9315

Affected Products

Mxsecurity Series

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9315 · Security Note
• https://moxa.com/en/support/product-support/security-advisory/mpsa-252631-cve-2025-9315-unauthenticated-device-registration-vulnerability-in-mxsecurity-series · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1998735811680854414 · Twitter Post
• https://t.me/cveNotify/145308 · Telegram Post
• https://twitter.com/CVEnew/status/1998732743396773987 · Twitter Post
• https://t.me/CVEtracker/39347 · Telegram Post