CISA warns hardcoded root keys in Moxa IIoT gateways enable traffic interception

CISA issues emergency industrial advisory over hardcoded root keys in Moxa AIG-302 IIoT edge computing gateways

The United States Cybersecurity and Infrastructure Security Agency has issued an urgent Industrial Control Systems advisory (ICSA-26-293-03) addressing two critical security vulnerabilities in Moxa AIG-302 Series Advanced Industrial Internet of Things (IIoT) edge gateways running ThingsPro Edge software. The advisory warns that an unauthenticated adversary with adjacent network access can extract a hardcoded root Certificate Authority private key directly from a system management binary, allowing malicious actors to decrypt, forge, and manipulate operational technology telemetry passing between industrial field devices and enterprise cloud environments.

Discovered by independent security researcher Ievgen Bondarenko, the vulnerability cluster comprises two distinct flaws: CVE-2026-109813, a high-severity (CVSS v4.0 score of 8.6) hardcoded cryptographic private key vulnerability embedded within the userland /usr/bin/sysman binary; and CVE-2026-109812, a medium-severity (CVSS v4.0 score of 6.9) missing authorization vulnerability affecting the device's internal /api/v1/secrets/ REST endpoint. Together, the flaws allow adjacent attackers to bypass authentication entirely, harvest sensitive cloud connection credentials, and launch undetected man-in-the-middle attacks across operational technology (OT) monitoring pipelines.

The Moxa AIG-302 Series occupies a critical junction within global industrial infrastructure, functioning as a ruggedized computing gateway that translates legacy operational fieldbus protocols (such as Modbus RTU, Modbus TCP, and CAN bus) into modern cloud-native telemetry streams destined for Microsoft Azure IoT Edge, Amazon Web Services IoT Core, and private enterprise MQTT brokers. Deployed extensively across energy substations, municipal water and wastewater treatment facilities, and oil and gas pipeline compressor stations, a cryptographic compromise of the gateway undermines the integrity of automated physical processes.

Moxa AIG-302 attack lifecycle: Key extraction to SCADA traffic hijacking

Zoom

The hardware profile: Armv7 Cortex-A7, industrial interfaces, and the bypassed TPM 2.0

The architectural severity of the Moxa disclosure is underscored by the physical engineering of the AIG-302 Series. Engineered for harsh industrial environments, the gateway is housed in a rugged SECC sheet metal enclosure rated IP30, designed for standard 35 mm DIN-rail mounting inside high-voltage electrical cabinets and remote telemetry units (RTUs). The device operates reliably across an extended industrial thermal envelope spanning from -40 degrees Celsius to +85 degrees Celsius, enduring extreme electromagnetic interference (EMI) compliant with EN 61000-6-2/6-4 industrial standards.

Internally, the gateway is powered by a 32-bit Armv7 dual-core Cortex-A7 processor running at 1.0 GHz (1,000 MHz), supported by 1 GB of onboard DDR3L SDRAM and 8 GB of eMMC flash storage hosting Moxa Industrial Linux (an enterprise distribution derived from Debian 11 Bullseye). The hardware architecture provides extensive fieldbus and network connectivity: two software-selectable RS-232/422/485 serial ports via DB9 male connectors, one Controller Area Network (CAN 2.0 A/B) interface, four digital inputs, four digital outputs, two auto-sensing 10/100/1000 Mbps Gigabit Ethernet ports (RJ45), and optional LTE Category 4 cellular connectivity with dual nano-SIM failover.

Crucially, the physical printed circuit board of the AIG-302 includes a dedicated, hardware-grade Trusted Platform Module (TPM v2.0) cryptoprocessor. The presence of this dedicated silicon chip creates a profound engineering paradox: while the hardware platform provided the cryptographic root of trust necessary to securely seal private keys inside tamper-resistant hardware non-volatile memory (NVRAM), the software engineering team at Moxa chose instead to hardcode root cryptographic authority keys directly into a plain-text userland software binary.

Cryptographic autopsy: Static RSA key extraction in /usr/bin/sysman (CVE-2026-109813)

The primary vulnerability, designated CVE-2026-109813 (CWE-321: Use of Hard-coded Cryptographic Key), resides within /usr/bin/sysman, a proprietary C/C++ compiled binary responsible for system management, firmware updates, and local device daemon orchestration across the ThingsPro Edge runtime. During forensic analysis of the firmware image, researcher Ievgen Bondarenko discovered that the cryptographic private key belonging to the gateway's internal root Certificate Authority (CA) was statically compiled directly into the binary's data segment.

In a robust Public Key Infrastructure (PKI) implementation, root private keys must possess maximum cryptographic entropy (such as 2,048-bit or 4,096-bit RSA keys generated pseudo-randomly during initial factory provisioning or on-premise commissioning). Furthermore, private keys must be sealed within hardware security modules or encrypted with per-device unique passphrases derived from hardware silicon identifiers. In the vulnerable ThingsPro Edge firmware (versions up to and including v1.4.0), every AIG-302 gateway deployed worldwide shipped with the exact same static private key bytes embedded in the sysman executable.

Because the private key was compiled into an unencrypted ELF executable, extracting it requires zero specialized hardware reverse-engineering tools. An attacker with local user access, an unauthenticated attacker downloading the publicly available firmware update bundle from Moxa's support website, or an adjacent adversary exploiting local network services can simply execute standard Linux utility strings or disassemble the binary using Ghidra or IDA Pro to recover the complete PEM-encoded RSA private key.

Once an adversary possesses the root CA private key, the gateway's entire cryptographic chain of trust evaporates. The attacker can forge valid digital certificates for any arbitrary domain name or internal hostname, issue counterfeit device certificates that are inherently trusted by the gateway's daemons, and establish rogue TLS endpoints that seamlessly terminate encrypted sessions without triggering certificate validation errors.

The API authorization failure: Dumping secrets via /api/v1/secrets/ (CVE-2026-109812)

Compounding the static private key compromise is CVE-2026-109812 (CWE-862: Missing Authorization), which affects the ThingsPro Edge local web service and administrative REST API. ThingsPro Edge exposes an internal HTTP/HTTPS web management interface on ports 80 and 443, enabling industrial engineers to configure fieldbus polling schedules, map Modbus register tables, and configure cloud connection profiles.

Within this API architecture, the endpoint /api/v1/secrets/ is intended to manage and store highly confidential integration credentials, including Microsoft Azure IoT Edge connection strings, Shared Access Signature (SAS) tokens, AWS IoT client certificates, MQTT broker usernames and passwords, and cellular APN authentication secrets. However, the route handler servicing /api/v1/secrets/ failed to enforce proper role-based access control (RBAC) or session validation on inbound HTTP GET requests.

An attacker with adjacent network connectivity and low-privileged authenticated credentials (or an attacker chaining minor session forgery quirks) can issue a simple HTTP GET request to /api/v1/secrets/ and receive a structured JSON payload containing the unencrypted plaintext credentials of all configured cloud integrations. By harvesting these connection strings, the attacker is no longer constrained to the local physical substation; they can pivot directly into the enterprise's upstream cloud tenant, impersonating the industrial gateway within Azure IoT Hub or AWS IoT Core.

Operational blast radius: SCADA, Modbus, CAN Bus, and Azure IoT Edge telemetry manipulation

The convergence of CVE-2026-109813 and CVE-2026-109812 creates an acute operational hazard for industrial control systems. Under the classical Purdue Enterprise Reference Architecture (Purdue Model), edge computing gateways occupy the crucial boundary between Level 2 (Supervisory Control / SCADA networks) and Level 4/5 (Enterprise IT and Cloud systems). Compromising this gateway grants adversaries bidirectional control across the operational barrier.

In a representative electrical substation deployment, an AIG-302 gateway continuously polls protective relays and power meters across RS-485 serial fieldbuses using Modbus RTU, collecting metrics on bus voltage, grid frequency, phase angle, and transformer oil temperatures. ThingsPro Edge ingests these raw registers, normalises the data into JSON telemetry, and encrypts the packets via TLS 1.3 before transmitting them over cellular LTE to an Azure IoT Edge container running predictive load-balancing algorithms.

An adversary armed with the extracted root CA private key can execute an Address Resolution Protocol (ARP) spoofing or DNS spoofing attack on the local substation switch, intercepting the gateway's outbound cloud traffic. Because the adversary holds the root signing key, they can present a forged TLS certificate that the gateway or upstream broker accepts as authentic. The adversary can then perform arbitrary man-in-the-middle manipulation:

1. Telemetry Falsification: The attacker can tamper with telemetry in transit, masking dangerous physical anomalies (such as an overheating 500 kV transformer) by injecting spoofed normal operating values into the cloud pipeline, blinding supervisory engineers in the centralized operations centre.

2. Command Injection: Conversely, the attacker can intercept outbound cloud-to-device control commands, altering Modbus coil-write or register-write payloads destined for field PLCs, potentially forcing breaker disconnects or tripping generator cooling pumps.

Quantifying vulnerability exposure: Firmware ranges, CVSS delta, and cryptographic entropy

The engineering parameters and security telemetry associated with CISA Advisory ICSA-26-293-03 reflect the stark divergence between robust physical hardware design and flawed software cryptographic implementation.

Table 1: Quantitative telemetry, cryptographic entropy metrics, and architectural parameters for the Moxa AIG-302 ThingsPro Edge vulnerability disclosure.

Architectural Dimension	Vulnerable Configuration (<= v1.4.0)	Remediated Configuration (v1.4.1)	Technical and Operational Impact
Root CA Private Key Storage	Hardcoded plain text in /usr/bin/sysman	Sealed in hardware TPM 2.0 NVRAM	Eliminates global shared private key across all shipping units
Effective Key Entropy	0 bits (statically compiled ELF byte array)	2,048 bits (unique per-device generated RSA)	Restores mathematical infeasibility of private key recovery
Primary Vulnerability Score	CVSS v4.0: 8.6 (High) / CVE-2026-109813	Remediated (Binary key removed)	Precludes unauthenticated adjacent TLS certificate forgery
API Authorization Enforcement	Unauthenticated GET /api/v1/secrets/	Mandatory Bearer token and RBAC validation	Prevents extraction of Azure IoT and MQTT connection strings
Secondary Vulnerability Score	CVSS v4.0: 6.9 (Medium) / CVE-2026-109812	Remediated (Token validation enforced)	Secures upstream cloud tenant access credentials
Hardware Cryptoprocessor	Onboard TPM 2.0 (bypassed by software)	Onboard TPM 2.0 (actively utilized)	Aligns firmware architecture with physical hardware security silicon
Operating Thermal Envelope	-40 deg C to +85 deg C (125 deg C span)	-40 deg C to +85 deg C (unchanged)	Physical ruggedness maintained across harsh industrial field deployments

The quantitative data illustrates that CVE-2026-109813 represents a total collapse of cryptographic entropy. An RSA key with zero entropy is equivalent to no encryption at all, transforming secure TLS tunnels into cleartext streams for any adversary possessing the firmware binary.

ThingsPro Edge cryptographic autopsy: Hardware TPM versus userland binary failure

Zoom

Epistemic audit: Stated CISA parameters versus unstated field telemetry

In evaluating industrial cybersecurity advisories, rigorous engineering analysis requires distinguishing between verified technical facts documented by CISA and Moxa, and operational details that remain unstated in the public record.

Table 2: Epistemic audit contrasting publicly disclosed advisory claims against unstated operational telemetry and withheld forensic parameters.

Investigative Parameter	Explicitly Stated in CISA / Moxa Bulletins	Unstated / Withheld from Public Disclosures	Analytical Evaluation & Risk
In-the-Wild Exploitation	CISA states no known public exploitation at time of release	Telemetry on private adversary scanning against industrial ports omitted	Standard advisory disclaimer; does not guarantee adversaries are not actively reverse-engineering the patch.
Root CA Scope of Trust	Private key in sysman compromises certificate validity	Full list of internal daemons trusting the root certificate not detailed	If peer devices trust the same CA, compromise extends beyond individual gateways to entire subnets.
Global Exposed Device Count	AIG-302 used globally across energy, water, and manufacturing	Total count of internet-accessible AIG-302 gateways worldwide withheld	Search engines like Shodan indicate thousands of Moxa devices with exposed web consoles.
Firmware Packaging Mechanism	ThingsPro Edge v1.4.1 resolves both CVEs	Details on whether patch revokes existing field certificates omitted	Upgrading firmware without rotating existing device certificates leaves historical trust compromised.
TPM Silicon Utilization History	AIG-302 includes hardware TPM 2.0 cryptoprocessor	Rationale for why previous firmware versions bypassed the TPM withheld	Points to legacy architectural debt where software suites were ported across older non-TPM hardware.

Remediation mandate: Firmware upgrade cadence and industrial network segmentation

To mitigate the critical risks exposed by CISA Advisory ICSA-26-293-03, asset owners and operational technology engineers responsible for Moxa AIG-302 gateways must execute an immediate, disciplined remediation programme across their operational environments:

1. Deploy ThingsPro Edge Firmware v1.4.1 Immediately: Operators must update all AIG-302 units to firmware version 1.4.1 or later. The updated firmware eliminates the hardcoded private key from /usr/bin/sysman, generates unique per-device cryptographic keypairs, and establishes strict token authorization across /api/v1/secrets/.

2. Rotate All Cloud Connection Strings and Tokens: Because previous firmware versions permitted unauthenticated extraction of cloud credentials via /api/v1/secrets/, asset owners must assume that all connection strings, SAS tokens, and MQTT passwords stored on vulnerable devices have been compromised. Operators must regenerate all Azure IoT Edge, AWS IoT, and MQTT credentials within their respective cloud tenant consoles.

3. Re-issue and Regenerate Local Device Certificates: Following the firmware upgrade, operators must regenerate all local TLS device certificates to sever the cryptographic trust chain tied to the compromised legacy root CA key.

4. Enforce Strict Fieldbus and Substation Micro-Segmentation: Ensure that AIG-302 gateways are never directly exposed to the public internet. Isolate fieldbus networks and gateway management interfaces behind dedicated industrial firewalls, restricting administrative web access (ports 80 and 443) strictly to authenticated jump hosts and VPN endpoints.