Which versions of Moxa UC-1200A are affected by EUVD-2026-36411?

Moxa UC-1200A series industrial computers contain a disk encryption bypass vulnerability (CVE-2026-9266) that allows attackers with physical access to recover encryption keys by intercepting SPI bus…

How to fix or mitigate EUVD-2026-36411?

Within 24 hours: Inventory all Moxa UC-1200A deployments and categorize by data sensitivity and physical location access. Within 7 days: Implement enhanced physical access controls (restricted facility access, asset monitoring, tamper detection seals) around affected devices and escalate to Moxa for security update timeline. Within 30 days: Establish a device replacement or compensation strategy if data criticality is high; monitor Moxa advisories for vendor-released patches and apply immediately upon availability.

Moxa UC-1200A EUVD-2026-36411

Q: What is the CVSS score of EUVD-2026-36411?

EUVD-2026-36411 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9266 HIGH

Missing Cryptographic Step (CWE-325)

2026-06-12 Moxa

GHSA-2j43-x625-hw9q

Information Disclosure Uc 1200A Series

7.0

CVSS 4.0 · Vendor: Moxa

Severity by source

Vendor (Moxa) PRIMARY

7.0 HIGH

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 MEDIUM

Physical access with chassis opening and SPI probing equipment justifies AV:P and AC:H; no auth or UI needed once physical, and full LUKS compromise yields C/I/A:H.

3.1 AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Moxa).

CVSS VectorVendor: Moxa

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 11:31 vuln.today

CVE Published

Jun 12, 2026 - 10:00 cve.org

HIGH 7.0

DescriptionCVE.org

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.

AnalysisAI

Disk encryption bypass in Moxa UC-1200A series industrial computers allows an attacker with invasive physical access to recover the LUKS disk encryption key by sniffing the SPI bus between the CPU and TPM2 chip. The flaw is an incomplete fix for CVE-2026-0714 - Moxa added TPM2 parameter encryption but misconfigured the authorization session so the encryption provides no real protection. No public exploit identified at time of analysis, and the CVSS 4.0 vector (AV:P) reflects that exploitation is bounded to attackers who can physically open the device.

Technical ContextAI

The affected products are Moxa UC-1200A series embedded Linux industrial computers/controllers, which use a discrete TPM 2.0 chip on the SPI bus to seal the LUKS (Linux Unified Key Setup) full-disk encryption key. CWE-325 (Missing Required Cryptographic Step) captures the root cause: TPM2 supports parameter encryption on authorization sessions to wrap sensitive command/response parameters (like the unsealed key) so that an attacker passively listening on the SPI bus sees only ciphertext. To actually be protective, the session must be created with the correct attributes - specifically an HMAC/policy session with encrypt/decrypt attributes and a non-NULL salted or bound session key. Moxa's firmware enables parameter encryption on the session but omits a required configuration step, so the derived session key is predictable or absent and the SPI traffic carrying the unsealed LUKS key remains effectively plaintext to anyone capturing the bus.

RemediationAI

Patch available per vendor advisory - apply the firmware update referenced in Moxa advisory MPSA-266240 at https://www.moxa.com/en/support/product-support/security-advisory/mpsa-266240-cve-2026-9266-missing-required-cryptographic-step-vulnerability-in-industrial-computers, which corrects the TPM2 authorization session configuration so parameter encryption actually protects the unsealed LUKS key on the SPI bus; the input data does not name an exact fixed firmware version, so confirm the target build with Moxa support before deployment. Because the attack requires invasive physical access, the most effective compensating controls while patching is rolled out are physical and environmental: install affected UC-1200A units in locked, tamper-evident enclosures with intrusion sensors wired to the SCADA alarm path, restrict cabinet keys and access logs, and deploy seals over chassis screws so tampering is detectable on inspection (trade-off: requires operational process for periodic seal checks). Where threat models include sophisticated physical attackers, consider migrating particularly sensitive data off the on-device encrypted volume to a network-attached store with separate access controls, or rotating LUKS keys after any suspected tamper event (trade-off: operational complexity and downtime). Do not rely on disabling TPM-backed LUKS as a workaround, since that removes at-rest protection entirely.