Moxa AIG-302 ThingsPro Edge
Summary
Moxa's AIG-302 ThingsPro Edge firmware versions prior to 1.4.0 are affected by two vulnerabilities, CVE-2026-109812 and CVE-2026-109813. These vulnerabilities, including missing authorization and the use of hard-coded cryptographic keys, could allow a privileged attacker with adjacent network access to obtain and disclose sensitive information. Moxa has released firmware version 1.4.1 as a fix.
IFF Assessment
The discovery of these vulnerabilities allows attackers to potentially obtain and disclose sensitive information, posing a risk to critical infrastructure sectors.
Severity
The CVSS score of 8.1 reflects a high severity due to the potential for an attacker to obtain and disclose sensitive information, which could include cryptographic key material, by exploiting missing authorization and hard-coded cryptographic keys.
Defender Context
Defenders should prioritize patching Moxa AIG-302 ThingsPro Edge devices to version 1.4.1 to mitigate the risks associated with these vulnerabilities. Monitoring for any unusual access patterns or data exfiltration attempts on industrial control systems is also crucial, especially in critical manufacturing, energy, and water/wastewater sectors.