cyfenced.com →

[ CVE-2026-109812 · Published 16 Oct 2026 ]

Vulnerability in Moxa AIG-302 Series

CVSS 6.9 EPSS <1%1 agency advisoryFix available

[ Description ]Official description

A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.

[ Fixes ]Fixes and patches

  • Security bulletin: Moxa MPSA-262560Vendor patch or bulletin · CERT-FR · moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-, cited by CERT-FR CERTFR-2026-AVI-1327

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1327

    Multiple vulnerabilities in Moxa AIG-302 Series Translated from French

    Multiple vulnerabilities have been discovered in Moxa AIG-302 Series. Some of them allow an attacker to cause a breach of data confidentiality, a breach of data integrity and a security policy bypass.

    CVE-2026-109813CVE-2026-109812

[ References ]References