Moxa AIG-302 ThingsPro Edge

Plan PatchCVSS 8.6ICS-CERT ICSA-26-293-03Oct 16, 2026

MoxaManufacturing

Summary

Two vulnerabilities exist in Moxa industrial computing products: CVE-2026-109812 (CVSS 6.9): Missing authorization on the `/api/v1/secrets/` internal API endpoint allows a low-privileged authenticated attacker with adjacent network access to retrieve sensitive information including cryptographic key material. CVE-2026-109813 (CVSS 8.6): A hard-coded root CA private key is embedded in `/usr/bin/sysman`. An unauthenticated attacker on the adjacent network could extract this key and use it to forge certificates, compromising the confidentiality and integrity of communications with downstream control equipment. Both vulnerabilities require adjacent network access but CVE-2026-109813 requires no authentication.

What this means

What could happen

An attacker on the same network segment could extract cryptographic keys and certificates from these Moxa devices, then use those keys to impersonate legitimate communications with PLCs and other control equipment, potentially altering commands or disabling safety checks. Additionally, an authenticated attacker could access stored secrets via an unprotected API endpoint.

Who's at risk

Manufacturing facilities running Moxa industrial computing products in process automation, data acquisition, or gateway roles. Any organization where these devices communicate with PLCs, RTUs, or safety systems over Ethernet should prioritize immediate access controls.

How it could be exploited

An unauthenticated attacker on the adjacent network (same switch/VLAN) could retrieve the hard-coded root CA private key from `/usr/bin/sysman` without any credentials, then use it to forge certificates and intercept or modify communications to downstream controllers. Alternatively, a low-privileged user on the same network could call the `/api/v1/secrets/` endpoint to retrieve sensitive data including cryptographic keys.

Prerequisites

Adjacent network access (same VLAN or local network segment)
CVE-2026-109813: No credentials required
CVE-2026-109812: Valid low-privileged user account on the device

remotely exploitable (adjacent network)no authentication required (CVE-2026-109813)low complexityaffects communications between control systemsno patch availablehard-coded cryptographic key exposure

Exploitability

Unlikely to be exploited — EPSS score 0.1%

Affected products (2)

1 pending1 EOL

ProductAffected VersionsFix Status

Industrial Computing ProductsAll versionsNo fix (EOL)

Moxa AIG-302 ThingsPro Edge firmware≤ 1.4.0No fix yet

Remediation & Mitigation

0/4

Do now

0/2

WORKAROUNDImmediately restrict network access to these Moxa devices to only authorized engineering workstations and control networks using firewall rules; block all adjacent network segments that do not require direct communication

WORKAROUNDIf the device runs a web service or API, disable or restrict the `/api/v1/secrets/` endpoint until a vendor patch is available

Mitigations - no patch available

0/2

Industrial Computing Products has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:

HARDENINGImplement network segmentation to isolate Moxa industrial computing products from untrusted networks and non-critical systems

HARDENINGDeploy certificate pinning or mutual TLS authentication on communications between Moxa devices and downstream PLCs to prevent key substitution attacks

CVEs (2)

CVE-2026-109812 CVE-2026-109813

View full CISA ICS-CERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/5945d54a-199f-4c03-b33c-dc95d10a681b

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.