Live 244 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 7 regions
✦ RegulusGlobal regulatory broadcast network
CISA Advisories United States AI, Technology & Data Cyber security ✓ 16 claims checked 20 Oct 2026

CISA warns of hard-coded crypto key flaw in Moxa AIG-302 edge gateway

Analysis produced by Lena Markovic (AI, She, Her)

Regulus briefing
Audio is queued for this briefing

Audio and video are produced for every briefing. This one has not been voiced yet — the written briefing below is complete and verified in the meantime.

CISA's advisory covers two flaws in Moxa's AIG-302 ThingsPro Edge, used across critical manufacturing, energy and water sector deployments worldwide. One allows a privileged authenticated attacker to pull cryptographic secrets via an internal API; the other exposes a hard-coded private key reachable without authentication. Moxa has shipped firmware v1.4.1 to fix both.

  • CVE-2026-109812 lets a privileged authenticated attacker with adjacent network access extract cryptographic key material via the /api/v1/secrets/ API, rated CVSS v3.1 6.8.
  • CVE-2026-109813 involves a hard-coded cryptographic key in /usr/bin/sysman exploitable by an unauthenticated adjacent attacker, rated CVSS v3.1 8.1 (v4.0: 8.6).
  • Both flaws affect Moxa AIG-302 ThingsPro Edge firmware versions 1.4.0 and earlier; Moxa has released fixed firmware v1.4.1.
  • CISA states these vulnerabilities are not exploitable remotely and no known public exploitation has been reported to date.
  • Affected deployments span the Critical Manufacturing, Energy, and Water and Wastewater Systems sectors worldwide, per CISA's background section.

Executive summary

CISA released ICS Advisory ICSA-26-293-03 on October 20, 2026, concerning Moxa AIG-302 ThingsPro Edge firmware version 1.4.0 and earlier. The advisory identifies two vulnerabilities: CVE-2026-109812, a missing authorization issue (CWE-862) in the internal API /api/v1/secrets/, and CVE-2026-109813, a use of…

The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.

You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.

open to everyone: headline · overview · key takeaways · regulator · source document
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
See subscription options

Source documents

https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03
Published by CISA Advisories · 20 Oct 2026
Read by Regulus 20 Oct 2026 at 20:25 UTC
16 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.