Moxa AIG-302 ThingsPro Edge: Two ICS Vulnerabilities Put OT Cryptographic Keys and API Secrets at Risk
Executive Summary
On October 20, 2026, CISA published ICS Advisory ICSA-26-293-03 disclosing two critical vulnerabilities in the Moxa AIG-302 ThingsPro Edge industrial IoT gateway running firmware version 1.4.0 and earlier. CVE-2026-109812 (CVSS 6.8) exposes a missing authorization flaw in the internal API endpoint /api/v1/secrets/, allowing a privileged but low-trust attacker with adjacent network access to retrieve cryptographic key material and sensitive configuration data. CVE-2026-109813 (CVSS 8.1) reveals a hard-coded cryptographic key embedded in /usr/bin/sysman, enabling an unauthenticated adjacent-network attacker to compromise both the confidentiality and integrity of all device communications. Both flaws are addressed in firmware v1.4.1, released by Moxa under security advisory MPSA-262560. Affected deployments span critical manufacturing, energy, and water and wastewater sectors worldwide.
These vulnerabilities arrive amid intensifying scrutiny of OT/ICS supply-chain security, where hard-coded credentials and weak access controls in edge devices continue to serve as reliable pivot points for nation-state and ransomware actors targeting industrial infrastructure. The Cybersecurity and Infrastructure Security Agency's active advisory cadence signals growing regulatory urgency around ICS device hygiene and adjacent-network threat surfaces.
Why This Matters Now
Hard-coded cryptographic keys and missing API authorization in edge ICS gateways expose critical infrastructure operators to confidentiality and integrity breaches without requiring internet-facing access—only adjacent network positioning. With energy, manufacturing, and water utilities under sustained threat from state-sponsored actors and ransomware groups in 2026, unpatched OT devices at the network edge represent an immediate, high-probability risk that demands urgent firmware updates and network segmentation.
Attack Path Analysis
An attacker with adjacent network access exploits a hard-coded cryptographic key (CVE-2026-109813) in the Moxa AIG-302 ThingsPro Edge firmware to compromise confidentiality and integrity of communications, then leverages a missing authorization vulnerability (CVE-2026-109812) against the internal API to extract cryptographic key material and sensitive secrets. The attack progresses from initial device compromise through privilege escalation via exposed secrets, lateral movement across the OT network using harvested credentials, command and control over compromised encrypted channels, and ultimately exfiltration of sensitive industrial data with potential for operational disruption.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
An unauthenticated attacker on the adjacent network exploits CVE-2026-109813, a hard-coded cryptographic key embedded in /usr/bin/sysman on Moxa AIG-302 ThingsPro Edge firmware <=1.4.0. The exposed private key material allows the attacker to intercept and manipulate encrypted communications between the ICS device and connected systems, establishing an initial foothold without requiring valid credentials.
Related CVEs
CVE-2026-109812
CVSS 6.9A missing authorization vulnerability in the internal API /api/v1/secrets/ of Moxa AIG-302 ThingsPro Edge firmware versions 1.4.0 and earlier allows a privileged authenticated attacker with adjacent network access to access sensitive information, potentially disclosing cryptographic key material.
Affected Products:
Moxa AIG-302 ThingsPro Edge firmware – <=1.4.0
Exploit Status:
no public exploitCVE-2026-109813
CVSS 8.6A hard-coded cryptographic key vulnerability in /usr/bin/sysman of Moxa AIG-302 ThingsPro Edge firmware versions 1.4.0 and earlier allows an unauthenticated attacker with adjacent network access to exploit exposed private key material, compromising the confidentiality and integrity of communications.
Affected Products:
Moxa AIG-302 ThingsPro Edge firmware – <=1.4.0
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Theft of Operational Information
Unsecured Credentials: Private Keys
Valid Accounts
Exploit Public-Facing Application
Data from Cloud Storage
Adversary-in-the-Middle
Drive-by Compromise
Obtain Capabilities: Digital Certificates
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Access Enforcement
Control ID: AC-3
NIST SP 800-53 Rev 5 – Authenticator Management: No Embedded Unencrypted Static Authenticators
Control ID: IA-5(7)
IEC 62443-3-3 – Human User Identification and Authentication
Control ID: SR 1.1
CISA Zero Trust Maturity Model 2.0 – Network Segmentation and Micro-Segmentation
Control ID: Network Pillar - Segmentation
NIS2 Directive – Security in Network and Information Systems Acquisition, Development, and Maintenance
Control ID: Article 21(2)(e)
DORA (EU 2022/2554) – ICT Security Policies - Access Control and Cryptographic Key Management
Control ID: Article 9(4)(d)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Oil/Energy/Solar/Greentech
Moxa AIG-302 ICS/OT vulnerabilities expose energy operational networks to cryptographic key theft and unauthorized API access, threatening SCADA confidentiality and grid integrity across worldwide deployments.
Utilities
Hard-coded cryptographic keys and missing authorization in ThingsPro Edge firmware enable adjacent-network attackers to compromise water, wastewater, and utility control system communications without authentication.
Industrial Automation
CVE-2026-109813 exposes private key material in industrial edge gateways, allowing lateral movement and data exfiltration across manufacturing OT environments lacking zero-trust segmentation and encrypted transit controls.
Critical Manufacturing
CISA-designated critical manufacturing sectors running Moxa AIG-302 firmware face confidentiality and integrity loss via CWE-862 and CWE-321 flaws exploitable by privileged adjacent-network adversaries on unpatched devices.
Sources
- Moxa AIG-302 ThingsPro Edgehttps://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03Verified
- Moxa Security Advisory MPSA-262560https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560Verified
- CISA ICS Security Recommended Practiceshttps://www.cisa.gov/icsVerified
- Moxa AIG-302 ThingsPro Edge Product Pagehttps://www.moxa.com/en/products/industrial-computing/arm-based-computers/aig-302-seriesVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant here because the attack chain depends on unrestricted adjacent network reachability to exploit hard-coded cryptographic keys and traverse a flat OT network. By enforcing segmented, identity-aware access boundaries across the ICS environment, Aviatrix would likely reduce the attacker's ability to move freely between industrial devices and exfiltrate data over unmonitored encrypted channels.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Broad adjacent network reachability to the vulnerable Moxa device would likely be constrained, reducing the pool of hosts capable of initiating exploitation of the hard-coded key material in the first place.
Control: Zero Trust Segmentation
Mitigation: Access to internal API endpoints responsible for secrets exposure would likely be scoped and constrained, reducing the number of identities or workloads that could reach /api/v1/secrets/ even after partial session compromise.
Control: East-West Traffic Security
Mitigation: Lateral reachability between industrial devices and management systems would likely be constrained, reducing the attacker's ability to reuse harvested credentials freely across a flat OT segment to reach controllers or adjacent workloads.
Control: Multicloud Visibility & Control
Mitigation: Anomalous or unauthorized encrypted communication patterns originating from the compromised device would likely be surfaced and may constrain the attacker's ability to maintain covert C2 channels that blend with expected device traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound data transfers from OT network segments to attacker-controlled external destinations would likely be constrained by egress policy, reducing the attacker's ability to complete bulk exfiltration of key material and industrial telemetry over uncontrolled channels.
If prior CNSF controls reduced lateral reach, constrained secrets exposure, and limited egress paths, the attacker's ability to sustain impact across the broader OT environment would likely be reduced to a narrower set of already-compromised assets rather than the full industrial network.
Impact at a Glance
Affected Business Functions
- Industrial Control System (ICS) Remote Monitoring and Data Acquisition
- Operational Technology (OT) Network Communications Security
- Critical Infrastructure Asset Management
- Secure Device Configuration and Secrets Management
Estimated downtime: N/A
Estimated loss: N/A
Exposure of cryptographic key material stored within the AIG-302 ThingsPro Edge firmware, including private keys used for securing ICS/OT communications. Successful exploitation of CVE-2026-109813 could allow an unauthenticated adjacent attacker to decrypt or forge communications between industrial gateways and upstream systems. CVE-2026-109812 could allow disclosure of secrets stored in the internal API, including credentials or keys used in critical manufacturing, energy, and water and wastewater infrastructure deployments worldwide. No confirmed data breach or active exploitation has been reported at time of advisory publication.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Zero Trust Segmentation to enforce microsegmentation and identity-based policies around OT/ICS network segments hosting Moxa AIG-302 devices, preventing lateral movement from a compromised device to adjacent controllers and management systems even when cryptographic credentials are harvested.
- • Implement East-West Traffic Security controls to monitor and restrict workload-to-workload and device-to-device communication within the OT network, enabling detection of anomalous lateral movement patterns that emerge after the exploitation of CVE-2026-109812 and CVE-2026-109813.
- • Enable Egress Security and Policy Enforcement with FQDN-based filtering on OT network egress points to block unauthorized outbound data transfers of exfiltrated cryptographic material and secrets to attacker-controlled destinations, directly countering the exfiltration stage.
- • Apply Multicloud Visibility and Control capabilities to establish traffic observability baselines for ThingsPro Edge API interactions, enabling detection of anomalous or repeated requests to /api/v1/secrets/ that indicate exploitation of the missing authorization vulnerability.
- • Enforce Encrypted Traffic (HPE) controls with MACsec or IPsec on adjacent network segments to ensure that even if hard-coded keys are exposed, traffic confidentiality and integrity are protected by independently managed encryption layers that cannot be compromised by a single device-level key disclosure.
