Advisories › Moxa › ICSA-26-293-03
Moxa AIG-302 ThingsPro Edge: 2 CVEs, High 8.1
Summary
CISA reports 2 vulnerabilities in Moxa Moxa AIG-302 ThingsPro Edge firmware. Weakness types: Missing Authorization, Use of Hard-coded Cryptographic Key. Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information. Highest CVSS v3 score: 8.1 (High), exploitable from an adjacent network.
What to do: Prioritize: Moxa has provided a fix for the vulnerability in v1.4.1. Users are encouraged to obtain and apply the update through one of the following methods:
Why this matters for oil & gas: Moxa serial servers and industrial switches are common in SCADA field networks.
At a glance
- Vendor
- Moxa
- Products
- Moxa AIG-302 ThingsPro Edge firmware
- CVEs
- CVE-2026-109812, CVE-2026-109813
- Highest CVSS v3
- 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy, Water and Wastewater Systems
- Deployed
- Worldwide
- Vendor HQ
- Taiwan
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-109812 | Missing Authorization | 6.8 | – | No | A missing authorization vulnerability exists in the internal API /api/v1/secrets/ for some of Moxa's industrial computing products. A privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material. |
| CVE-2026-109813 | Use of Hard-coded Cryptographic Key | 8.1 | – | No | A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman for some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications. |
Affected products (1)
- Moxa Moxa AIG-302 ThingsPro Edge firmware: <=1.4.0
Vendor fixes and mitigations (from advisory)
- Mitigation: Moxa has provided a fix for the vulnerability in v1.4.1. Users are encouraged to obtain and apply the update through one of the following methods:
- Mitigation: If the AIG-302 has Internet access, login to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update.
- Mitigation: Users can download the v1.4.1 patch manually from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch. link
- Mitigation: For more information refer to Moxa's security advisory MPSA-262560 link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.