Moxa AIG-302 CVE-2026-109812

Exploitation requires the attacker to (1) already hold a valid low-privileged authenticated session on the Moxa AIG-302 device, and (2) have adjacent (Layer-2 / same logical network segment, non-routable) network access to reach the internal /api/v1/secrets/ API - it is not exploitable from the open internet or by an unauthenticated party. The limiting factors are therefore the need for pre-existing credentials (PR:L) and network adjacency (AV:A); no user interaction and no special non-default configuration is required once those conditions hold, and impact is confined to confidentiality (disclosure of secrets/key material) with no integrity or availability effect.

This is a moderate-severity broken access control issue (CWE-862, CVSS 4.0 base 6.9 / Medium) in Moxa's AIG-302 series industrial IoT gateways. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) consistently points to a constrained but impactful flaw: exploitation requires adjacent network position (AV:A, not fully remote) and an existing low-privileged authenticated session (PR:L), but once those preconditions are met the attack is low-complexity with no user interaction and yields high confidentiality impact (VC:H) with no integrity or availability effect. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no signal of active or probable near-term exploitation - this reads as a genuine data-exposure concern rather than a mass-exploitation emergency. The high-confidentiality impact is amplified by the specific disclosure of cryptographic key material, which could enable follow-on compromise, so it should not be dismissed purely on its Medium score. Signals are internally consistent; the main gap is the absence of exploitation-probability data (EPSS) and any confirmation of exploit availability.

An attacker who has obtained low-privilege credentials on an AIG-302 gateway (or compromised a device on the same adjacent network segment) directly queries the internal /api/v1/secrets/ API, which fails to enforce authorization checks. The endpoint returns sensitive data including cryptographic key material, which the attacker then uses to decrypt traffic or impersonate the device. No public exploit identified at time of analysis; exploitation is constrained to adjacent network access rather than fully remote.