As cited
Copy frozen at (site build).
vulnerabilities
Moxa AIG-302 ThingsPro Edge
The Moxa AIG-302 ThingsPro Edge industrial computing device contains two vulnerabilities in firmware version 1.4.0 and earlier: CVE-2026-109812, a missing authorization flaw in the /api/v1/secrets/ endpoint that allows authenticated adjacent network attackers to access sensitive data including cryptographic keys, and CVE-2026-109813, a hard-coded cryptographic key in /usr/bin/sysman exploitable by unauthenticated adjacent network attackers. Moxa has released firmware version 1.4.1 as a patch available through the device web console or manual download from the Moxa Software Release Service.
Why it matters: Operators of Moxa AIG-302 devices in critical manufacturing, energy, and water systems worldwide must update to firmware 1.4.1 immediately to prevent attackers on adjacent networks from extracting cryptographic material and compromising device communications.
- Source published
- First seen by Cybersecurity Tracker