CVE-2026-109812 & CVE-2026-109813: Moxa AIG-302 ThingsPro Edge Missing Authorization and Hard-Coded Key — ICS Defense Guide

CISA has published ICS advisory ICSA-26-293-03 covering two vulnerabilities in Moxa's AIG-302 ThingsPro Edge industrial IoT gateway: CVE-2026-109812 (Missing Authorization on the internal API endpoint /api/v1/secrets/) and CVE-2026-109813 (Use of Hard-coded Cryptographic Key). Both carry a CVSS v3 score of 8.1 (High), and successful exploitation allows an attacker to obtain and disclose sensitive information from affected devices.

This is not a theoretical concern. The AIG-302 is an industrial edge computing gateway deployed across Critical Manufacturing, Energy, and Water and Wastewater sectors worldwide. These devices sit at the convergence point of IT and OT — they aggregate telemetry from PLCs and field devices, store cloud credentials, and broker north-south traffic. Secrets stored on a ThingsPro Edge gateway frequently include cloud API tokens, MQTT broker credentials, VPN keys, and certificates that provide lateral movement paths into both enterprise and control system environments. An unauthenticated path to /api/v1/secrets/ is exactly the kind of foothold that turns a perimeter nuisance into an OT incident.

If you operate Moxa gateways anywhere in your environment — and many organizations don't even know they do, since these devices are often deployed by engineering teams outside IT's asset inventory — you need to inventory, patch, and segment immediately.

Technical Analysis

Affected Products and Versions

CVE-2026-109812 — Missing Authorization on /api/v1/secrets/

The internal REST API exposed by ThingsPro Edge includes an endpoint at /api/v1/secrets/ that fails to enforce proper authorization checks. From a defender's perspective, the critical facts are:

• Attack vector: Network-based. An attacker who can reach the ThingsPro Edge management/API interface can query the secrets endpoint without possessing valid credentials.
• Exploitation requirements: No authentication, no user interaction. Reachability is the only prerequisite — which is why network segmentation posture determines whether this is a CVSS 8.1 in practice or a theoretical issue.
• Impact: Disclosure of sensitive information. On an IIoT edge gateway, "sensitive information" routinely means cloud service credentials, pre-shared keys, certificates, and device provisioning secrets — material that directly enables follow-on compromise.

CVE-2026-109813 — Use of Hard-coded Cryptographic Key

The second flaw involves a cryptographic key embedded in the firmware itself. The defensive implication is severe: anyone who obtains the firmware image (publicly downloadable from the vendor, or extracted from a device) can recover the key and apply it against every device running the affected firmware. Hard-coded keys defeat the entire purpose of per-device credential uniqueness. Whatever that key protects — encrypted configuration data, stored secrets, or API token material — is protected by a secret that isn't secret.

How the Attack Chain Plays Out

A realistic exploitation sequence against an exposed AIG-302:

1. Reconnaissance: Attacker identifies reachable ThingsPro Edge management interfaces — via internet scanning (if the device is directly exposed), via a compromised IT host, or via a flat OT network with no segmentation.
2. Initial access: Unauthenticated HTTP(S) requests to /api/v1/secrets/ return sensitive material (CVE-2026-109812).
3. Key recovery: Attacker extracts or reuses the hard-coded cryptographic key (CVE-2026-109813) to decrypt protected data or forge trusted material.
4. Follow-on: Harvested credentials are used against cloud IoT endpoints, MQTT brokers, or upstream systems the gateway connects to — pivoting from one gateway into the broader environment.

Exploitation Status

At the time of this writing, the advisory reflects a coordinated disclosure. There is no confirmed public statement of active in-the-wild exploitation in the advisory summary, and the CVEs have not been listed in CISA's Known Exploited Vulnerabilities catalog at publication. However, ICS-adjacent vulnerabilities with unauthenticated information disclosure routinely attract rapid PoC development — the /api/v1/secrets/ path is trivially scannable, and hard-coded keys are extractable by anyone with the firmware. Treat both as exploitable and prioritize remediation as if exploitation were imminent. Defenders should monitor the CISA KEV catalog for additions.

Detection & Response

The most reliable detection surface for these vulnerabilities is web/API access logging in front of the device — reverse proxies, firewall logs, Zeek/Suricata on OT network spans, and SIEM-ingested syslog. The AIG-302 is a Linux-based embedded appliance, so endpoint telemetry options are limited; network-layer detection is where your fidelity lives.

SIGMA Rules

The first rule targets web server/proxy logs for requests to the vulnerable endpoint. The second targets network connections to ThingsPro Edge management interfaces originating from hosts outside the authorized OT management zone — the segmentation-violation signal that matters most for reachability-based flaws.

---
title: Moxa ThingsPro Edge Secrets API Access Attempt
tid: 3c7a1f94-2b6d-4e58-9a31-8f0d5c2e7b19
status: experimental
description: Detects HTTP requests to the Moxa AIG-302 ThingsPro Edge internal secrets API endpoint (/api/v1/secrets/), associated with CVE-2026-109812 missing authorization vulnerability. Any request to this path from non-administrative sources is suspicious.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.109812
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains:
      - '/api/v1/secrets'
      - '/api/v1/secrets/'
  condition: selection
falsepositives:
  - Legitimate administrator access to the ThingsPro Edge management API from authorized engineering workstations (tune by source IP allowlist)
level: high
---
title: Unauthorized Host Connecting to OT Edge Gateway Management Interface
tid: 8e2b5d17-6c4a-4f93-b128-3d9a6e0c5f42
status: experimental
description: Detects network connections to common industrial edge gateway management ports (443, 8443, 8080) from source hosts flagged as outside the OT management zone. Relevant to exploitation reachability for CVE-2026-109812/CVE-2026-109813 on Moxa AIG-302 devices.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03
  - https://attack.mitre.org/techniques/T1046/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: network_connection
detection:
  selection_port:
    DestinationPort:
      - 443
      - 8443
      - 8080
  selection_dst:
    DestinationIp|contains:
      - '10.20.' # Replace with your OT/edge gateway subnet(s)
      - '192.168.10.' # Replace with your OT/edge gateway subnet(s)
  filter_admin_hosts:
    SourceIp|contains:
      - '10.20.5.' # Authorized OT management jump hosts
  condition: selection_port and selection_dst and not filter_admin_hosts
falsepositives:
  - Legitimate southbound monitoring/SCADA polling if management and telemetry ports overlap; scope destination subnets carefully to gateway management interfaces only
level: medium

KQL — Microsoft Sentinel / Defender

The following query hunts for requests to the vulnerable secrets endpoint across firewall, proxy, and syslog-ingested data. ICS and network device logs typically land in CommonSecurityLog via CEF or in Syslog via the AMA connector. Adjust the device subnets to your environment.

// Hunt for access attempts to Moxa ThingsPro Edge /api/v1/secrets/ (CVE-2026-109812)
let MoxaSubnets = dynamic(["10.20.", "192.168.10."]); // Replace with your AIG-302 subnets
union isfuzzy=true
    (CommonSecurityLog
    | where RequestURL has_any ("/api/v1/secrets")
    | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, RequestMethod, DeviceAction, DeviceVendor, DeviceProduct
    | extend Source = "CEF"),
    (Syslog
    | where SyslogMessage has_any ("/api/v1/secrets", "thingspro", "aig-302")
    | where SyslogMessage has_any (MoxaSubnets) or SyslogMessage has "secrets"
    | project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage
    | extend Source = "Syslog")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Attempts=count()
    by SourceIP, DestinationIP, RequestURL, Source
| order by Attempts desc;

// Companion hunt: enumerate all hosts communicating with suspected Moxa gateway management interfaces
// to build your authorized-access baseline before tuning detections
let MoxaSubnets = dynamic(["10.20.", "192.168.10."]);
CommonSecurityLog
| where DestinationIP has_any (MoxaSubnets)
| where DestinationPort in (443, 8443, 8080)
| summarize Connections=count(), UniqueSources=dcount(SourceIP), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
    by DestinationIP, DestinationPort
| order by Connections desc;

Velociraptor VQL

Velociraptor is relevant here on the jump hosts and engineering workstations that legitimately administer ThingsPro Edge devices. If one of those hosts is compromised, it becomes the launch point for API abuse. This artifact hunts for processes and network connections touching gateway management ports from Windows/Linux management hosts, plus evidence of harvested secrets staged locally (e.g., files referencing the secrets API path in browser history, scripts, or download directories).

-- Hunt management-zone hosts for connections to OT edge gateways and
-- evidence of scripts/curl abusing the ThingsPro Edge secrets API
SELECT Pid, Name, CommandLine, Exe, Username,
       Conn.LocalIP, Conn.LocalPort, Conn.RemoteIP, Conn.RemotePort, Conn.Status
FROM pslist()
LET Conn = netstat()
WHERE (CommandLine =~ '/api/v1/secrets'
       OR CommandLine =~ '(?i)(curl|wget|invoke-webrequest|iwr).*(8443|8080).*'
       OR Exe =~ '(?i)(curl|wget)')
   OR (Conn.RemotePort IN (8443, 8080)
       AND Conn.RemoteIP =~ '^(10\\.20\\.|192\\.168\\.10\\.)')  -- adjust to gateway subnets

For file-artifact hunting on potentially compromised engineering workstations:

-- Search for downloaded or scripted references to the ThingsPro secrets API
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/*/Downloads/*',
  '/home/*/Downloads/*',
  'C:/Users/*/Documents/*',
  '/tmp/*'
], accessor='auto')
WHERE FullPath =~ '(?i)(secret|thingspro|aig-302|moxa)'
   AND Mtime > now() - 14*24*3600  -- last 14 days

Remediation / Hardening Verification Script

Use the following Bash script from a management host to inventory reachable AIG-302 devices, probe for the vulnerable endpoint exposure (unauthenticated reachability test), and audit firewall exposure. Run read-only checks only — the curl probe uses an unauthenticated GET solely to confirm whether the endpoint answers without credentials.

#!/usr/bin/env bash
# Moxa AIG-302 ThingsPro Edge - CVE-2026-109812 exposure audit
# Run from an authorized OT management host. READ-ONLY verification.

set -euo pipefail

GATEWAY_LIST="${1:-gateways.txt}"   # one IP/FQDN per line
MGMT_PORTS=(443 8443 8080)
REPORT="aig302_exposure_$(date +%Y%m%d_%H%M%S).csv"

echo "device,port,service_reachable,secrets_endpoint_unauth_status,firmware_hint" > "$REPORT"

while read -r dev; do
  [[ -z "$dev" || "$dev" =~ ^# ]] && continue
  for port in "${MGMT_PORTS[@]}"; do
    # 1. Is the management interface reachable at all?
    if ! timeout 3 bash -c "</dev/tcp/$dev/$port" 2>/dev/null; then
      echo "$dev,$port,closed,," >> "$REPORT"
      continue
    fi

    scheme="http"; [[ "$port" == "443" || "$port" == "8443" ]] && scheme="https"

    # 2. Unauthenticated probe of the vulnerable endpoint (CVE-2026-109812)
    status=$(curl -k -s -o /dev/null -w '%{http_code}' --max-time 5 \
      "$scheme://$dev:$port/api/v1/secrets/" || echo "ERR")

    # 3. Pull firmware version hint from device info endpoint if exposed
    fw=$(curl -k -s --max-time 5 "$scheme://$dev:$port/api/v1/system/info" \
         | grep -oE '"(firmware|fw_?version)"[^,}]*' | head -1 || echo "unknown")

    echo "$dev,$port,open,$status,$fw" >> "$REPORT"

    if [[ "$status" == "200" ]]; then
      echo "[CRITICAL] $dev:$port - /api/v1/secrets/ returns 200 WITHOUT authentication"
    elif [[ "$status" == "401" || "$status" == "403" ]]; then
      echo "[OK]       $dev:$port - endpoint enforces authorization ($status)"
    fi
  done
done < "$GATEWAY_LIST"

echo
echo "Report written to $REPORT"
echo "Any device on firmware <= 1.4.0 with a 200 response requires immediate isolation and patching."

A 200 response from an unauthenticated client means the missing-authorization condition is live and reachable in your environment — treat it as an incident, pull the device's access logs if available, and rotate every secret stored on the gateway.

Remediation

Act on these in order of risk reduction:

1. Upgrade firmware immediately. Update all Moxa AIG-302 ThingsPro Edge devices running firmware ≤ 1.4.0 to the fixed release identified in CISA ICSA-26-293-03 and Moxa's corresponding security advisory on the Moxa security advisories page. Confirm the post-upgrade version on every unit — do not assume automated updates applied to embedded OT gear.

2. Rotate all secrets stored on affected devices — this is non-negotiable. Because CVE-2026-109813 involves a hard-coded cryptographic key, any secret previously stored on an affected gateway must be considered potentially compromised. Rotate cloud API tokens, MQTT broker credentials, VPN pre-shared keys, certificates, and any credentials provisioned through ThingsPro Edge. Firmware patching does not un-disclose data that may already have been read.

3. Enforce strict network segmentation. The AIG-302's management and API interfaces must never be reachable from the internet, from general IT user subnets, or from flat OT segments. Restrict access to a dedicated OT management VLAN, permit only enumerated jump hosts, and deny all other east-west traffic to gateway management ports. Verify with the audit script above from a non-management subnet — the probe should fail.

4. Verify no direct internet exposure. Query your external attack surface (and check Shodan/Censys internally) for exposed Moxa management interfaces. Any gateway with a public IP must be rehomed behind the firewall immediately, and its secrets rotated per step 2.

5. Deploy the detections above. Forward firewall, proxy, and Zeek logs for OT segments into your SIEM; enable the Sigma rules with your environment's subnets and allowlists; run the KQL hunt retroactively over at least 30 days of data to check for prior access to /api/v1/secrets/.

6. Audit your asset inventory. If this advisory is the first time you've learned you own AIG-302s, that gap is itself a finding. Reconcile engineering procurement records, PLC/edge network diagrams, and passive OT asset discovery output against your CMDB. You cannot patch what you have not cataloged.

7. Review connected-system exposure. Every system the gateway authenticates to — cloud IoT hubs, historians, SCADA masters — inherits the risk of compromised gateway credentials. Review authentication logs on those upstream systems for anomalous sessions originating from gateway identities.

CISA consistently recommends that organizations minimize network exposure for all control system devices, locate them behind firewalls, and isolate them from business networks — this advisory is a textbook case for why. For organizations subject to IEC 62443, NIST CSF, or sector-specific requirements (NERC CIP for energy, AWIA for water), document this remediation as part of your vulnerability management program evidence.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub