As reported by CISA in advisory ICSA-26-293-03, Moxa's AIG-302 ThingsPro Edge industrial gateway is carrying two notable vulnerabilities — CVE-2026-109812 and CVE-2026-109813 — that could expose sensitive information including cryptographic key material to authenticated attackers on adjacent networks. While the individual CVSS scores land in the medium range, the combined risk profile for operational technology (OT) environments is considerably higher than the numbers suggest.
Why This Matters More Than the Score Suggests
The aggregate CVSS v3 score of 8.1 (High) tells part of the story, but the real concern here is the type of vulnerability, not just the severity rating. A missing authorization flaw in an API endpoint called /api/v1/secrets/ — a path that by its very name should be among the most fiercely guarded in any system — combined with a hard-coded cryptographic key vulnerability, creates a compounding risk. If an attacker can reach that internal API from an adjacent network and the authorization checks are missing, the hard-coded key issue means that even rotated credentials may be recoverable or predictable.
In OT and industrial IoT environments, edge gateways like the AIG-302 sit at the boundary between field devices and higher-level networks. They often handle protocol conversion, data aggregation, and secure tunneling. That makes them attractive pivot points for threat actors looking to move laterally between IT and OT segments.
Vulnerability Details
| CVE | Type | CWE | CVSS v3.1 | CVSS v4.0 | Exploited in Wild? |
|---|---|---|---|---|---|
| CVE-2026-109812 | Missing Authorization in /api/v1/secrets/ | CWE-862 | 6.8 (Medium) | 6.9 (Medium) | No confirmed exploitation reported |
| CVE-2026-109813 | Use of Hard-coded Cryptographic Key | CWE-321 (implied) | Contributing to aggregate 8.1 | — | No confirmed exploitation reported |
- Affected Product:
- Moxa AIG-302 ThingsPro Edge, firmware versions ≤ 1.4.0
- Patch Status:
- Fixed in firmware v1.4.1 — available via Moxa's Web Console auto-update or manual download from the AIG-302 product page / Moxa Software Release Service
- Vendor Advisory:
- Moxa MPSA-262560
- Attack Vector:
- Adjacent network (AV:A), requires low-privilege authenticated access (PR:L), no user interaction required
The combination of a missing-authorization flaw in a secrets-handling API with a hard-coded cryptographic key is the kind of vulnerability pairing that turns a "medium" into a real-world critical incident. In OT environments where these gateways often store tunnel credentials and device certificates, the blast radius can extend well beyond the initial compromise.
Who Is Most at Risk
- Critical Manufacturing — facilities using AIG-302 gateways for protocol bridging between PLCs and monitoring systems
- Energy sector — substations and distributed energy resources where edge gateways aggregate telemetry
- Water and Wastewater — remote pumping stations and treatment plant SCADA integrations that rely on Moxa edge devices
- Any deployment where the AIG-302 is reachable from a shared or semi-trusted network segment — the adjacent-network attack vector means that VLAN separation alone may not be sufficient if the attacker has any foothold on the OT network
Broader Implications
Hard-coded cryptographic keys in industrial edge devices remain a persistent industry problem. When vendors ship devices with embedded keys that cannot be rotated without a firmware update, the security posture of the entire deployment depends on the vendor's patch cycle. Organizations should demand that their OT device suppliers support customer-managed key rotation and provide clear documentation of cryptographic key handling — not just at procurement, but as part of ongoing vendor risk management.
Additionally, the missing-authorization flaw in an internal API endpoint underscores a pattern we see repeatedly in IoT and OT firmware: internal management APIs that are assumed to be unreachable by external actors but are exposed on network interfaces reachable from the plant floor. Defense-in-depth means treating every API endpoint as potentially exposed, regardless of the intended architecture.
Shield53 Recommendations — Immediate Actions
/api/v1/secrets/ in device logs or network flow data. Any unexpected API calls from non-administrative sources should be treated as a potential indicator of compromise.While no active exploitation has been confirmed as of this advisory's publication, the visibility of CISA's ICS advisory means that proof-of-concept development is likely already underway. The window between advisory publication and in-the-wild exploitation for OT devices has been shrinking — treat this as a patch-this-week, not a patch-next-quarter situation.
