# Moxa AIG-302 ThingsPro Edge key exposure flaws

Published: 2026-10-20 · Severity: routine · Sectors: Manufacturing, Energy, Infrastructure
Canonical: https://vorant.io/reports/acf318b3-9b92-55c8-a09c-bf905be2ddb7/moxa-aig-302-thingspro-edge-key-exposure-flaws

> Two vulnerabilities in Moxa AIG-302 ThingsPro Edge firmware ≤1.4.0 allow disclosure of cryptographic key material; patched in v1.4.1.

CISA published an ICS advisory for two vulnerabilities affecting Moxa AIG-302 ThingsPro Edge industrial computing firmware version 1.4.0 and earlier. CVE-2026-109812 is a missing authorization flaw (CWE-862) in the internal API /api/v1/secrets/ that could let a privileged, authenticated attacker with adjacent network access retrieve sensitive data including cryptographic key material. CVE-2026-109813 is a hard-coded cryptographic key vulnerability (CWE-321) in /usr/bin/sysman that could let an unauthenticated attacker with adjacent network access obtain exposed private key material, compromising confidentiality and integrity of communications.

Both issues require adjacent network access rather than remote internet-based exploitation, and CISA states these vulnerabilities are not exploitable remotely and no public exploitation has been reported. Affected sectors include Critical Manufacturing, Energy, and Water and Wastewater Systems, with worldwide deployment; Moxa is headquartered in Taiwan.

Moxa has released firmware v1.4.1 to remediate both issues, obtainable via the AIG-302 Web Console's Software Upgrades function or manually from Moxa's product site or Software Release Service. CISA recommends standard ICS hardening: minimizing internet exposure of control system devices, isolating control networks behind firewalls, and using VPNs for remote access where needed. The vulnerability was reported to CISA by researcher Ievgen Bondarenko.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109812, CVE-2026-109813

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/acf318b3-9b92-55c8-a09c-bf905be2ddb7/moxa-aig-302-thingspro-edge-key-exposure-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup