Successful exploitation of these vulnerabilities, discovered by researcher Ievgen Bondarenko, could allow an attacker to obtain and disclose sensitive information.
The Moxa AIG-302 Series is a rugged, programmable Industrial Internet of Things (IIoT) gateway powered by an Arm Cortex-A7 dual-core 1 GHz processor. It runs ThingsPro Edge software and supports Azure IoT Edge to bridge field-level operational technology (OT) with cloud platforms and local supervisory systems (SCADA).
The following versions of Moxa AIG-302 ThingsPro Edge suffer from the vulnerabilities: Moxa AIG-302 ThingsPro Edge firmware up to and including version 1.4.0.
In one issue, a missing authorization vulnerability exists in the internal API /api/v1/secrets/ for some of Moxa’s industrial computing products. A privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.
CVE-2026-109812 is the case number for the vulnerability, which has a CVSS V3 base score of 6.8. There is also a V4 base score of 6.9.
Cryptographic Key Vulnerability
Additionally, a hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman for some of Moxa’s industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.
CVE-2026-109813 is the case number for the vulnerability, which has a CVSS V3 base score of 8.1. There is also a V4 base score of 8.6.
The product sees use in the critical manufacturing, energy, and water and wastewater systems sectors, and on a global basis.
No exploit currently targets these vulnerabilities. These vulnerabilities are not exploitable remotely.
In terms of mitigations, Moxa has a fix for the vulnerability in v1.4.1. Users can obtain and apply the update through one of the following methods:
- If the AIG-302 has Internet access, login to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update.
- Users can download the v1.4.1 patch manually from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch.
- Users can download the v1.4.1 patch manually from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch.
For more information refer to Moxa’s security advisory MPSA-262560.