Hard-coded key in Moxa's AIG-302 gateway hands attackers the keys to industrial comms

Key points

• Moxa's AIG-302 ThingsPro Edge gateway shipped with the same cryptographic private key baked into every unit, meaning anyone who extracts it once can impersonate any device on the local network, per CVE-2026-109813, published 16 October 2026.
• A second flaw, CVE-2026-109812, lets a privileged but low-level authenticated user hit an internal secrets API and pull out confidential data including key material.
• Both bugs are fixed in firmware version 1.4.1; everything up to and including 1.4.0 is vulnerable.
• The gateways are deployed worldwide in critical manufacturing, energy, water and wastewater systems, according to CISA.
• CISA says there is no known public exploitation and the flaws cannot be reached from the open internet, only from an adjacent network.

Moxa, the Taiwanese industrial networking vendor, has patched two vulnerabilities in its AIG-302 ThingsPro Edge gateway, a small computer that sits inside factories and utilities and shuttles sensor data up to the cloud.

The uglier of the two is a hard-coded cryptographic key. Every AIG-302 running firmware 1.4.0 or earlier ships with the same secret private key burned into a system binary called sysman. Pull it off one device and you can decrypt or forge traffic to any other device of the same model within reach. It's the embedded-world equivalent of every house on the street using the same key, cut at the factory.

This is the fourth ICS-related advisory we've covered in under a month. Our 6 October story on a 9.8-severity industrial email flaw and our 19 October piece on refrigeration controller bugs both turned on the same underlying problem: vendors shipping embedded devices into critical infrastructure with hygiene that wouldn't pass a 2010 web-app review.

How bad is it, really?

Bad in context, limited in reach. The bug is rated 8.6 high on CVSS 4.0 and needs no login, but an attacker has to be on an adjacent network, meaning the same local or operational-technology segment as the gateway. The public internet isn't in scope.

That caveat matters less than it sounds. Industrial gateways like the AIG-302 often sit on flat plant networks alongside contractor laptops and engineering workstations. Adjacent-network access, in a lot of real factories, is the default state for anyone who gets a foothold.

The second bug, CVE-2026-109812, is a classic missing-authorization problem on the internal API path /api/v1/secrets/. Any authenticated user with at least some privileges can call it and read secrets they shouldn't see. It's rated 6.9 medium, and it's the kind of web hygiene failure that shouldn't be shipping in 2026 firmware.

What should operators do?

Update to firmware 1.4.1, then rotate anything the gateway was holding. The patch closes both holes, but it can't un-leak a private key that was identical across every unit shipped. Treat any certificate or shared secret the device was trusted to protect as burned.

Moxa's web console has a Check for upgrades button under Maintenance, Software Upgrades, which is the easiest route for anything with outbound internet. Air-gapped sites can download the 1.4.1 package from Moxa's software release portal and side-load it through the same menu.

The bugs were reported to CISA by researcher Ievgen Bondarenko. CISA's standing advice applies here with extra weight: keep these devices off the public internet, segment them from the business network, and if remote access is unavoidable, put it behind a VPN that's itself kept current.

A hard-coded key in a device sold into water utilities and manufacturing plants isn't an exotic threat. It's the oldest embedded sin in the book. The fact that it still ships in 2026 is what's worth sitting with.