Authenticated administrator takeover via unchecked API account creation

Privilege escalation in affected Moxa network security appliances and routers allows remote authenticated users to gain device administration. The account-management API fails to enforce role authorization when processing administrator-account creation, so a low-privileged account can create an administrator, even under an existing username. Low-privileged credentials and network access to the API are required; exploitation grants control of the affected device and enables account impersonation.