Project and affected component
ThingsPro Edge firmware through v1.4.0 on Moxa AIG-302 industrial gateways: the internal /api/v1/secrets/ endpoint and hard-coded Root CA private-key material in /usr/bin/sysman.
Security boundary
Access to sensitive secrets must be authorized for the requesting principal. A shared cryptographic private key embedded in firmware crosses a separate device-to-device communication trust boundary.
Vulnerability class
CVE-2026-109812: CWE-862, missing authorization (CVSS 4.0 6.9 Medium). CVE-2026-109813: CWE-321, use of a hard-coded cryptographic key (CVSS 4.0 8.6 High).
CVE-2026-109812 - Missing Authorization
Moxa documents insufficient authorization in the internal /api/v1/secrets/ interface. Under the stated adjacent-network and authenticated-attacker prerequisites, sensitive information including cryptographic key material could be exposed.
CVE-2026-109813 - Hard-coded Cryptographic Key
Moxa documents a shared hard-coded Root CA private key in /usr/bin/sysman. The exposed key material could undermine the confidentiality and integrity of communications under the advisory conditions.
Root cause
The two findings concern independent trust failures: a sensitive API endpoint did not enforce sufficient authorization, while firmware contained shared private cryptographic key material. They should not be represented as one chained exploit.
Public evidence
Moxa advisory MPSA-262560 describes both defects and acknowledges Ievgen Bondarenko. The published CVE records identify him as the finder, and CISA ICSA-26-293-03 credits him as the reporting researcher. This public page does not claim an independent retest of firmware 1.4.1.
Practical impact
The advisory describes potential disclosure of secrets and compromise of communications confidentiality and integrity under adjacent-network conditions. No attack on an operational industrial system, host code execution, or physical effect is claimed.
Disclosure status
Moxa published MPSA-262560 on October 16, 2026, and CISA published ICSA-26-293-03 on October 20, 2026. Both publicly acknowledge Ievgen Bondarenko for the research.
Remediation
Moxa identifies firmware v1.4.1 as the security update for affected AIG-302 devices. General corrective principles include enforcing authorization for sensitive API resources and removing shared hard-coded private-key material; the public advisory does not describe the exact implementation of the fixes.
Sector context
CISA lists Critical Manufacturing, Energy, and Water and Wastewater Systems as deployment sectors for the affected product. This is sector context, not a claim that live infrastructure was tested.