CVE-2026-109812 in AIG-302
Summary
by MITRE • 10/16/2026
A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The identified security flaw represents a critical failure in access control mechanisms within Moxa's industrial computing product line, specifically affecting the internal API endpoint located at /api/v1/secrets/. This vulnerability is classified as an insecure direct object reference or broken access control issue, where the system fails to verify whether the authenticated user has sufficient privileges to request sensitive data. The core technical deficiency lies in the server-side logic which accepts requests from any validly authenticated session without validating the role or permission level of that specific account against the requested resource. Consequently, an attacker who possesses low-privileged credentials can interact with this endpoint as if they were a high-level administrator or system owner. This architectural oversight allows for the unauthorized retrieval of data that is intended to be restricted to privileged operations only, highlighting a significant gap in the implementation of role-based access control principles within the device's management interface.
From an operational perspective, the impact of exploiting this vulnerability extends far beyond simple information disclosure. The endpoint specifically exposes cryptographic key material and other sensitive secrets stored on the device. In industrial computing environments, these keys are often used for securing communications between devices, encrypting data at rest, or authenticating connections to central management servers. If an attacker gains access to these private keys, they can decrypt previously captured traffic, impersonate legitimate devices within the network, or forge authentication tokens to escalate their privileges further. This compromises not only the confidentiality of the specific device but also potentially undermines the integrity and availability of the broader industrial control system by allowing unauthorized entities to inject malicious commands or disrupt critical operations under the guise of a trusted component.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-269, which describes Improper Privilege Control, as well as CWE-862, Missing Authorization, indicating that the software does not perform proper checks on user privileges before allowing access to resources. In terms of offensive security frameworks, this exploitation path corresponds to MITRE ATT&CK technique T1078, Valid Accounts, where adversaries use legitimate credentials to maintain persistence and move laterally within a network without triggering typical intrusion detection alerts associated with brute-force or credential stuffing attacks. The requirement for adjacent network access means that physical proximity or being on the same local area network segment is necessary to initiate the attack, which limits remote exploitation but does not mitigate the risk in environments where internal networks are often trusted and poorly segmented.
To mitigate this vulnerability, immediate remediation should focus on enforcing strict authorization checks at the API level for all endpoints handling sensitive data such as cryptographic keys. Developers must implement role-based access control that explicitly denies requests from non-administrative users attempting to access secret management functions regardless of their authentication status. Additionally, implementing principle of least privilege ensures that even if an account is compromised, its capabilities are limited to only those actions necessary for its intended function. Network segmentation strategies should also be reviewed to ensure that internal APIs are not unnecessarily exposed on network segments accessible by general-purpose workstations or untrusted devices. Regular security audits and penetration testing focused on API authentication flows can help identify similar gaps in access control logic before they are exploited in production environments, thereby strengthening the overall resilience of industrial computing infrastructure against insider threats and lateral movement attacks.