Moxa AIG-302 ThingsPro Edge Firmware Vulnerabilities Disclosed

CISA published advisory ICSA-26-293-03 on October 20, 2026, detailing two vulnerabilities in Moxa AIG-302 ThingsPro Edge industrial computing products. The affected firmware versions are 1.4.0 and earlier.

CVE-2026-109812: A missing authorization vulnerability exists in the internal API endpoint /api/v1/secrets/. A privileged authenticated attacker with adjacent network access could exploit this flaw to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.

CVE-2026-109813: A hard-coded cryptographic key vulnerability exists in /usr/bin/sysman. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.

Both vulnerabilities affect critical infrastructure sectors, including Critical Manufacturing, Energy, Water and Wastewater Systems. The products are deployed worldwide, with Moxa headquartered in Taiwan.

Moxa has addressed the flaws in firmware version 1.4.1. Users with Internet access can update via the Web Console under Maintenance > Software Upgrades. Those without direct Internet access can download the v1.4.1 patch manually from the official Moxa AIG-302 product website or the Moxa Software Release Service and upload it via the Package Upload feature in the Web Console. Further details are available in Moxa security advisory MPSA-262560.