CVE-2026-109812: Moxa Aig-302 Series

Medium severity, CVSS 6.9. EPSS: 0.1% chance of exploitation in the next 30 days.

A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.

Affected products

• Moxa Aig-302 Series: from 1.0.0, up to and including 1.4.0

Published 2026-10-16. Last modified 2026-10-16.