Moxa UC-1200A up to 1.4 missing cryptographic step

Summaryinfo

A vulnerability labeled as critical has been found in Moxa UC-1200A up to 1.4. This affects an unknown function. Executing a manipulation can lead to missing cryptographic step. This vulnerability is handled as CVE-2026-9266. The physical device can be targeted for the attack. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Moxa UC-1200A up to 1.4. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a missing cryptographic step vulnerability. The CWE definition for the vulnerability is CWE-325. The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.

The weakness was released by Cyloq. The advisory is shared for download at moxa.com. This vulnerability was named CVE-2026-9266 since 05/22/2026. The exploitation appears to be easy. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-36411). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Automation Software

Vendor

• Moxa

Name

• UC-1200A

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4

License

• commercial

Website

• Vendor: https://www.moxa.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion