Two Vulnerabilities Discovered in Moxa AIG-302 ThingsPro Edge Firmware
CISA alerts to two critical vulnerabilities in Moxa AIG-302 ThingsPro Edge firmware, potentially allowing adjacent network attackers to steal sensitive information and compromise communications.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory detailing two significant vulnerabilities affecting Moxa's AIG-302 ThingsPro Edge industrial computing devices. These flaws, identified as CVE-2026-109812 and CVE-2026-109813, could permit an attacker with adjacent network access to compromise the device's security, potentially impacting critical infrastructure sectors.
The first vulnerability, CVE-2026-109812, is classified as a "Missing Authorization" flaw within the internal API endpoint /api/v1/secrets/. This weakness could allow a privileged, authenticated attacker with adjacent network access to exploit the vulnerability. Successful exploitation could lead to the disclosure of sensitive information, including confidential data and cryptographic key material, thereby undermining the device's security posture.
Complementing this, CVE-2026-109813 involves the "Use of Hard-coded Cryptographic Key" within the /usr/bin/sysman component. This vulnerability is particularly concerning as it exposes private key material. An unauthenticated attacker with adjacent network access could leverage this flaw to compromise the confidentiality and integrity of communications handled by the affected devices.
Both vulnerabilities affect Moxa AIG-302 ThingsPro Edge firmware versions prior to 1.4.1. The potential impact is rated with a CVSS v3.1 base score of 6.8 for CVE-2026-109812 (medium severity) and 8.1 for CVE-2026-109813 (high severity), indicating a significant risk to affected systems.
Moxa has acknowledged these issues and has released firmware version 1.4.1 to address them. Users are strongly encouraged to update their devices to the latest version to mitigate these risks. The update can be applied either automatically via the AIG-302 Web Console if the device has internet access, or manually by downloading the patch from Moxa's official product website or Software Release Service.
The affected devices are deployed worldwide and are critical to sectors such as Critical Manufacturing, Energy, and Water and Wastewater Systems. The potential for an adjacent network attacker to gain access to sensitive information or compromise communications highlights the importance of timely patching and robust network segmentation for industrial control systems.
CISA recommends that organizations minimize network exposure for all control system devices, ensuring they are not accessible from the internet. Implementing firewalls, isolating control system networks from business networks, and utilizing secure remote access methods like VPNs are crucial defensive measures. Organizations should also perform thorough impact analyses and risk assessments before deploying any security updates or mitigations.
These vulnerabilities were reported to CISA by Ievgen Bondarenko. Further details and mitigation guidance can be found in Moxa's security advisory MPSA-262560.