Skip to content
OpenAdvisories
High ICSA-26-293-03 2 CVEs

Moxa AIG-302 ThingsPro Edge

Published Oct 20, 2026 · Updated Oct 20, 2026

Vendor: Moxa Product: AIG-302 ThingsPro Edge firmware

Summary

Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information.

Vulnerabilities 2

  • High 8.6
    CVE-2026-109813

    Shared Hard-coded Root CA Private Key

    A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentia…

    Moxa AIG-302 Series ICS / OT
  • Medium 6.9
    CVE-2026-109812

    Missing Authorization on Secret Endpoints

    A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive info…

    Moxa AIG-302 Series ICS / OT

Revision history

  1. #1

    Initial Publication

References