Moxa AIG-302 ThingsPro Edge key exposure flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Two vulnerabilities in Moxa AIG-302 ThingsPro Edge firmware ≤1.4.0 allow disclosure of cryptographic key material; patched in v1.4.1.
CISA published an ICS advisory for two vulnerabilities affecting Moxa AIG-302 ThingsPro Edge industrial computing firmware version 1.4.0 and earlier. CVE-2026-109812 is a missing authorization flaw (CWE-862) in the internal API /api/v1/secrets/ that could let a privileged, authenticated attacker with adjacent network access retrieve sensitive data including cryptographic key material. CVE-2026-109813 is a hard-coded cryptographic key vulnerability (CWE-321) in /usr/bin/sysman that could let an unauthenticated attacker with adjacent network access obtain exposed private key material, compromising confidentiality and integrity of communications.
Both issues require adjacent network access rather than remote internet-based exploitation, and CISA states these vulnerabilities are not exploitable remotely and no public exploitation has been reported. Affected sectors include Critical Manufacturing, Energy, and Water and Wastewater Systems, with worldwide deployment; Moxa is headquartered in Taiwan.
Moxa has released firmware v1.4.1 to remediate both issues, obtainable via the AIG-302 Web Console's Software Upgrades function or manually from Moxa's product site or Software Release Service. CISA recommends standard ICS hardening: minimizing internet exposure of control system devices, isolating control networks behind firewalls, and using VPNs for remote access where needed. The vulnerability was reported to CISA by researcher Ievgen Bondarenko.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,702 reports from 144 sources, 534 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs