High Patch available CVSS up to 8.1
Moxa AIG-302 ThingsPro Edge flaws could expose sensitive data
CISA ICS AdvisoriesMoxa · critical manufacturing, energy, water and wastewaterCVE-2026-109812, CVE-2026-109813
What happened. Moxa AIG-302 ThingsPro Edge firmware up to 1.4.0 has two flaws: missing authorisation and a hard-coded cryptographic key. One lets a privileged attacker with adjacent network access read sensitive data, including keys. Moxa has provided a fix.
Who is affected. Moxa AIG-302 ThingsPro Edge firmware 1.4.0 and earlier. Sectors named: critical manufacturing, energy, and water and wastewater.
What to do. Check whether you run Moxa AIG-302 ThingsPro Edge firmware 1.4.0 or earlier and apply the fix Moxa has provided.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L2
Why: The source describes an industrial computing product, an edge gateway that most likely sits at the supervisory level (L2); the report does not state its level.
- Are you exposed?
Check the firmware version of every Moxa AIG-302 in your asset inventory and look for 1.4.0 or earlier.
- If you cannot fix it yet
- Restrict adjacent network access to the gateway to known management hosts only.
- Limit privileged accounts on the device and rotate credentials and keys once the fix is applied.
- Watch for
- Requests to the /api/v1/secrets/ path from unexpected hosts.
- Logins to the device by privileged accounts from unfamiliar addresses.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA ICS Advisories (opens cisa.gov)
More on Moxa Manufacturing Energy and power Water and wastewater CVE-2026-109812 CVE-2026-109813