This vulnerability arises from an omission in the authorization session configuration of TPM2 parameter encryption in Moxa UC-1200A Series firmware version 1.0. Although TPM2 parameter encryption was introduced to mitigate CVE-2026-0714, the missing cryptographic step renders the encryption ineffective. An attacker with invasive physical access can capture TPM communications on the SPI bus and extract the LUKS disk encryption key in plaintext, leading to full compromise of the encrypted disk volume. Remote exploitation is not feasible, and no downstream systems are affected. No official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation results in full compromise of the encrypted disk volume by revealing the LUKS disk encryption key in plaintext. However, exploitation requires invasive physical access to the device, including opening the device and attaching external equipment to the SPI bus. Remote attacks are not possible, and the vulnerability does not impact downstream systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should restrict physical access to affected devices to prevent invasive attacks. Monitor vendor communications for updates regarding patches or mitigations.