Is CVE-2026-109812 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-109812

Update Moxa AIG-302 ThingsPro Edge firmware to version 1.4.1. If the device has Internet access, use the Web Console (Maintenance > Software Upgrades) to check for and apply the update. If no Internet access is available, download the v1.4.1 patch from the official Moxa AIG-302 product website or Moxa Software Release Service and upload it via the Web Console under Maintenance > Software Upgrades > Package Upload. Refer to Moxa security advisory MPSA-262560 for more information.

Quick answers

What is CVE-2026-109812?: Update Moxa AIG-302 ThingsPro Edge firmware to version 1.4.1. If the device has Internet access, use the Web Console (Maintenance > Software Upgrades) to check for and apply the update. If no Internet access is available, download the v1.4.1 patch from the official Moxa AIG-302 product website or Moxa Software Release Service and upload it via the Web Console under Maintenance > Software Upgrades > Package Upload. Refer to Moxa security advisory MPSA-262560 for more information.
How severe is CVE-2026-109812?: high, CVSS 6.9
Is CVE-2026-109812 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-109812 be mitigated?: Update Moxa AIG-302 ThingsPro Edge firmware to version 1.4.1. If the device has Internet access, use the Web Console (Maintenance > Software Upgrades) to check for and apply the update. If no Internet access is available, download the v1.4.1 patch from the official Moxa AIG-302 product website or Moxa Software Release Service and upload it via the Web Console under Maintenance > Software Upgrades > Package Upload. Refer to Moxa security advisory MPSA-262560 for more information.

CVSS

6.9

Vendor

Moxa

Published

Oct 21, 2026 · 01:14

Patch

Unknown / not confirmed

Affected products

Moxa AIG-302 ThingsPro Edge

Mitigation

Moxa AIG-302 ThingsPro Edge Firmware Vulnerabilities Disclosed

CISA and Moxa have disclosed two vulnerabilities affecting Moxa AIG-302 ThingsPro Edge firmware versions 1.4.0 and earlier. CVE-2026-109812 is a missing authorization flaw in the internal API that could allow a privileged authenticated attacker with adjacent network access to disclose sensitive data, including cryptographic keys. CVE-2026-109813 is a hard-coded cryptographic key vulnerability that could allow an unauthenticated attacker with adjacent network access to compromise the confidentiality and integrity of communications. Moxa has released firmware version 1.4.1 to address both issues.

—1m

CVE-2026-109812

Quick answers

Related News

Moxa AIG-302 ThingsPro Edge Firmware Vulnerabilities Disclosed