Source: cisa.gov
CISA issued an ICS advisory for Moxa AIG-302 ThingsPro Edge firmware versions 1.4.0 and earlier, identifying two vulnerabilities. CVE-2026-109812 is a missing authorization flaw in the internal API /api/v1/secrets/ that allows a privileged authenticated attacker with adjacent network access to access sensitive information including cryptographic key material. CVE-2026-109813 is a hard-coded cryptographic key vulnerability in /usr/bin/sysman that allows an unauthenticated attacker with adjacent network access to compromise confidentiality and integrity of communications. The highest CVSS v3.1 score is 8.1 (HIGH). Affected sectors include Critical Manufacturing, Energy, and Water and Wastewater Systems. Moxa has released firmware v1.4.1 as a fix, available via the AIG-302 Web Console or manual download. No known public exploitation has been reported at this time.
