Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-109812 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.7 MEDIUMVector:CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-2026-109812,-cve-2026-109813-vulnerabilities-in-industrial-computing-products	[email protected]	AdvisoryBundleRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-862	Missing Authorization	[email protected]

Affected Products

Product	Versions
Moxa AIG-302	<v1.4.1 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: v1.4.1moderate effort If the AIG-302 has Internet access: Log in to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update. Download the v1.4.1 patch manually: Download the patch from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch.

Product

Versions

Moxa AIG-302

<v1.4.1 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: v1.4.1moderate effort
If the AIG-302 has Internet access: Log in to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update. Download the v1.4.1 patch manually: Download the patch from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 16, 2026	CVE Modified	CISA-ADP
Oct 16, 2026	New CVE Received	[email protected]