Moxa AIG-302 ThingsPro Edge through 1.4.0 can leak keys

Original title: Moxa AIG-302 ThingsPro Edge

CISA Advisoriesby CISAOct 20, 2026 · 12:00 UTC (5d ago)4 min read8 · 3 reads

AI summary · x-ai/grok-4.7Summaries by Vani AI

An unauthenticated adjacent attacker can abuse a hard-coded key; a logged-in user can read the secrets API.

Moxa AIG-302 ThingsPro Edge firmware 1.4.0 and earlier has two flaws fixed in v1.4.1. CVE-2026-109813 exposes a hard-coded private key in sysman to an unauthenticated adjacent attacker and is scored CVSS 8.1. CVE-2026-109812 lets a privileged authenticated adjacent user read /api/v1/secrets/, including cryptographic key material.

Key facts

CVE-2026-109812 is CVSS 6.8, CWE-862, with high confidentiality impact only.
CVE-2026-109813 is CWE-321 and is also scored CVSS 4.0 at 8.6.
Affected devices are used in manufacturing, energy, and water systems worldwide.
Ievgen Bondarenko reported both issues to CISA.

Security assessment · AI, from the article

Impact: Key disclosure and loss of communication confidentiality and integrity

Product	Affected	Fixed in
Moxa AIG-302 ThingsPro Edge firmware	<=1.4.0	1.4.1

What to do

1.Install ThingsPro Edge v1.4.1 via the web console or a manual package upload.
2.Keep AIG-302 devices off the internet and isolate them from business networks.

Analyze CVE-2026-109812 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-109812 CVE-2026-109813

Tags: moxa thingspro ics hard-coded-key missing-authorization

Vendors: Moxa
Products: AIG-302 ThingsPro Edge
Organizations: CISA
Countries: Taiwan

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-109813 +1 related CVE CVE-2026-109812	Hard-coded key in Moxa sysman (adjacent network)	8.6 group max	—		9d ago

From the original article

4 min read at cisa.gov

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information. The following versions of Moxa AIG-302 ThingsPro Edge are affected: Moxa AIG-302 ThingsPro Edge firmware Software Upgrades, and click Check for upgrades to check for and obtain the update. Mitigation Users can download the v1.

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.