Moxa AIG
Reporting by CISA ICS AdvisoriesRead the original at cisa.gov
Executive Summary
Two vulnerabilities, CVE-2026-109812 and CVE-2026-109813, affect Moxa AIG-302 ThingsPro Edge firmware versions up to and including 1.4.0. The first vulnerability is a Missing Authorization flaw within the internal API at /api/v1/secrets/, which allows a privileged attacker with adjacent network access to disclose sensitive data, potentially including cryptographic key material. The second issue is the presence of a hard-coded cryptographic key in the /usr/bin/sysman executable, enabling an unauthenticated attacker with adjacent network access to compromise communications confidentiality and integrity via the exposed private key.
The immediate resolution provided by Moxa is applying firmware update v1.4.1. This patch can be deployed either automatically through the AIG-302 Web Console if internet access is available, or manually via package upload using a downloaded file from the official product website or Moxa Software Release Service. The affected device is relevant to critical infrastructure sectors globally, including manufacturing, energy, and water systems. CISA recommends defensive measures such as minimizing network exposure, isolating control systems behind firewalls, and utilizing secure remote access methods like VPNs.
Facts Only
Moxa identified two vulnerabilities in Moxa AIG-302 ThingsPro Edge firmware versions less than or equal to 1.4.0.
CVE-2026-109812 is a missing authorization vulnerability in the internal API /api/v1/secrets/.
This flaw allows a privileged authenticated attacker with adjacent network access to potentially disclose confidential data, including cryptographic key material.
CVE-2026-109813 involves a hard-coded cryptographic key vulnerability in the /usr/bin/sysman component.
This exposure enables an unauthenticated attacker with adjacent network access to compromise communication integrity and confidentiality.
The risk CVSS score for the combined issues is 8.1 (v3).
Moxa has issued a fix available in firmware version v1.4.1 for both vulnerabilities.
Mitigation methods include checking for upgrades via the AIG-302 Web Console or manually uploading the patch package.
Affected sectors mentioned include Critical Manufacturing, Energy, and Water and Wastewater Systems, deployed worldwide.
No known public exploitation targeting these vulnerabilities has been reported to CISA.
Full Take
The core narrative presents a clear technical danger: weaknesses allowing internal data theft (CVE-2026-109812) and unauthenticated communication compromise (CVE-2026-109813) within industrial hardware used in vital infrastructure. The strength of the advisory lies in providing precise remediation steps (firmware v1.4.1) while acknowledging that the threats are contingent upon adjacent network access, not remote public internet exposure. This distinction—local access required versus global accessibility—is critical for assessing immediate risk prioritization.
However, this technical urgency is layered with a strategic pattern of controlled defense escalation. By detailing methods for both automated and manual patching, Moxa creates multiple paths to compliance, yet the repeated instructions serve to frame the necessity of vendor reliance. Furthermore, CISA’s recommendations lean heavily toward perimeter hardening (firewalls, VPNs), which, while sound defensive hygiene, subtly shifts agency away from the device owner toward network architecture specialists. This reinforces a systemic dependency on complex external security controls over intrinsic product resilience.
The underlying paradigm is one where operational technology (OT) devices must operate under assumptions of eventual compromise, forcing continual patching cycles onto stable, critical systems. The unstated assumption underpinning this crisis disclosure is that asset owners possess the necessary IT/OT expertise and uptime allowances to execute a firmware upgrade without disrupting essential services—a significant hurdle in many industrial environments.
How do operational constraints within ICS environments challenge the prescriptive nature of vendor-supplied patches? Does over-reliance on layered perimeter defense risk creating overly complex, brittle security postures rather than inherently secure devices? If an attacker bypasses traditional network segmentation, how resilient are device-level defenses against such documented intrinsic flaws?
Patterns detected: none
From the original · CISA ICS Advisories
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information.Read the full story at cisa.gov
Sentinel — Human
This text appears to be a highly structured, synthesized compilation of technical vulnerability data directly sourced from official security advisories. The presentation leans heavily toward mechanical data delivery rather than journalistic interpretation.