CVE-2026-109812: CWE-862: Missing Authorization in Moxa AIG-302 Series

This vulnerability (CWE-862) involves missing authorization checks in the internal API endpoint `/api/v1/secrets/` of Moxa AIG-302 Series devices. An attacker with low privileges and adjacent network access can exploit this to retrieve sensitive data such as cryptographic keys. The affected versions are from 1.0.0 up to and including 1.4.0. The CVSS 4.0 vector indicates low attack complexity, no user interaction, and high impact on confidentiality. No known exploits are reported in the wild, and no official patch or vendor advisory details are provided.

Exploitation could lead to unauthorized disclosure of sensitive information, including cryptographic key material, which may compromise the confidentiality of communications or stored data on affected devices. The attacker requires low privileges and adjacent network access, which limits the attack surface but still poses a significant risk in environments where such access is possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict adjacent network access to the affected devices and monitor for unauthorized access attempts. Avoid exposing the internal API to untrusted networks.