Missing Authorization & Hard‑Coded Key Vulnerabilities in Moxa AIG‑302 ThingsPro Edge (CVE‑2026‑109812, CVE‑2026‑109813)
What It Is — Two critical flaws in Moxa’s AIG‑302 ThingsPro Edge firmware (≤ 1.4.0). One is a missing‑authorization issue in the internal /api/v1/secrets/ endpoint; the other is the use of a hard‑coded cryptographic key. Both enable an authenticated attacker on the same network segment to retrieve confidential data, including key material.
Exploitability — CVSS v3.1 base score 8.1 (High). The vulnerabilities are exploitable by a privileged attacker with adjacent‑network access; no public proof‑of‑concept is required.
Affected Products — Moxa AIG‑302 ThingsPro Edge industrial edge gateway, firmware version ≤ 1.4.0.
Why It Matters for Trust & Control Assurance
- Highlights the necessity of continuous verification that internal APIs enforce least‑privilege access, a core control‑objective across frameworks.
- Hard‑coded keys break cryptographic‑key‑management best practices, eroding audit‑ready evidence of secure key handling.
- For operators of critical‑infrastructure OT, the gap can be surfaced in real‑time via a Trust Center dashboard, providing defensible proof of remediation.
Recommended Actions
- Upgrade all AIG‑302 devices to firmware v1.4.1 or later.
- Perform a post‑patch audit of API authorization policies and confirm removal of hard‑coded keys.
- Integrate continuous monitoring of internal API calls into your control‑evidence pipeline to demonstrate ongoing compliance.
Source: US‑CERT Advisory