Moxa AIG-302 ThingsPro Edge
view advisory published 2026-10-20
Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-109813US | —OT elevated | — | ||
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network acce… | ||||
| CVE-2026-109812US | —OT elevated | — | ||
A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with ad… | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-26-293-03 JSONself
- ICSA Advisory ICSA-26-293-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (2)
- MitigationMoxa AIG-302 ThingsPro Edge firmware
If the AIG-302 has Internet access, login to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update.
- MitigationMoxa AIG-302 ThingsPro Edge firmware
If the AIG-302 has Internet access, login to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan