VulnSocial

CVE-2026-109812

LOWCVSS 6.9 · MEDIUM

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post
  • Aviatrix Threat Research Center@aviatrixtrc

    A hard-coded cryptographic key in Moxa AIG-302 ThingsPro Edge firmware (CVE-2026-109813) lets unauthenticated adjacent attackers recover private key material and compromise device communications — no credentials required. Combined with a missing authorization flaw on the /api/v1/secrets/ API (CVE-2026-109812), attackers can escalate access and extract secrets across ICS gateways in manufacturing, energy, and water systems. In OT environments where trust boundaries rely on shared key infrastructure, compromised cryptographic material can enable lateral movement that bypasses conventional security controls entirely. #ThreatIntel #ICS 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/icsa-26-293-03-moxa-aig-302-thingspro-edge-cve-2026-109812-cve-2026-109813

    0000049
    2.0K followersView on X

Explore more

Back to dashboard