CVE-2026-0714: Moxa Industrial Linux TPM Disclosure Flaw

CVE-2026-0714 Overview

A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the discrete TPM is connected to the CPU via an SPI bus. Exploitation requires invasive physical access, including opening the device and attaching external equipment to the SPI bus to capture TPM communications. If successful, the captured data may allow offline decryption of eMMC contents. This attack cannot be performed through brief or opportunistic physical access and requires extended physical access, possession of the device, appropriate equipment, and sufficient time for signal capture and analysis. Remote exploitation is not possible.

Critical Impact

Successful exploitation allows complete offline decryption of encrypted eMMC storage contents, potentially exposing sensitive industrial control system configurations, credentials, and operational data.

Affected Products

• Moxa Industrial Computers with TPM-backed LUKS full-disk encryption
• Moxa Industrial Linux 3 operating system
• Devices with discrete TPM connected to CPU via SPI bus

Discovery Timeline

• February 5, 2026 - CVE-2026-0714 published to NVD
• February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0714

Vulnerability Analysis

This vulnerability falls under CWE-319 (Cleartext Transmission of Sensitive Information), specifically relating to the transmission of cryptographic secrets over an unprotected SPI bus between the discrete TPM and the CPU. In the affected Moxa industrial computers, the TPM communicates with the main processor using the Serial Peripheral Interface (SPI) protocol without additional encryption or authentication on the bus itself.

When the system boots and LUKS full-disk encryption is initialized, the TPM unseals the encryption key and transmits it to the CPU. Because the SPI bus operates without additional cryptographic protection, an attacker with physical access to the device's internals can intercept this communication using hardware probing equipment such as logic analyzers or bus sniffers connected directly to the SPI traces.

Root Cause

The root cause stems from the hardware architecture decision to use a discrete TPM connected via SPI without implementing additional transport layer encryption. While TPM 2.0 specifications include provisions for encrypted sessions, the implementation on affected Moxa industrial computers transmits sensitive key material in cleartext over the SPI bus. This architectural weakness means that the full-disk encryption key can be captured by monitoring the communication channel between the TPM and CPU during the boot sequence.

Attack Vector

The attack requires physical possession of the target device and invasive access to its internal components. An attacker must:

1. Gain extended physical access to the Moxa industrial computer
2. Open the device enclosure to access the circuit board
3. Identify the SPI bus traces connecting the discrete TPM to the CPU
4. Attach probing equipment (such as a logic analyzer) to the SPI bus
5. Power on the device to capture TPM-to-CPU communications during boot
6. Analyze the captured SPI traffic to extract the LUKS encryption key
7. Use the extracted key to decrypt the eMMC storage contents offline

This attack methodology requires specialized hardware knowledge, appropriate probing equipment, and sufficient time to perform signal capture and cryptographic analysis. The physical access requirement means remote exploitation is not possible, but organizations must consider insider threat scenarios and physical security controls.

Detection Methods for CVE-2026-0714

Indicators of Compromise

• Physical signs of device tampering such as broken seals, scratches near screw locations, or evidence of enclosure opening
• Presence of foreign materials or adhesive residue on the circuit board indicating probe attachment
• Unusual device behavior or boot anomalies following physical access incidents
• Evidence of unauthorized firmware modifications or configuration changes

Detection Strategies

• Implement tamper-evident seals on device enclosures and establish regular physical inspection schedules
• Deploy hardware-based intrusion detection mechanisms such as tamper switches or chassis intrusion sensors
• Maintain detailed physical access logs for all industrial computer installations
• Conduct periodic integrity verification of device configurations and firmware versions

Monitoring Recommendations

• Establish baseline documentation of device physical state including photographs of enclosure seals
• Implement video surveillance in areas where affected industrial computers are deployed
• Configure alerting for any unexpected device reboots that could indicate tampering attempts
• Maintain asset inventory tracking with physical security status indicators

How to Mitigate CVE-2026-0714

Immediate Actions Required

• Review and enhance physical security controls for all affected Moxa industrial computer installations
• Implement tamper-evident seals on device enclosures and establish inspection procedures
• Restrict physical access to authorized personnel only with documented access control policies
• Evaluate the sensitivity of data stored on affected devices and consider additional encryption layers

Patch Information

Moxa has released a security advisory addressing this vulnerability. Organizations should consult the Moxa Security Advisory MPSA-255121 for specific remediation guidance and any available firmware updates that may address this issue. Contact Moxa technical support to determine if updated hardware configurations with integrated TPM or encrypted SPI communications are available.

Workarounds

• Deploy affected devices in physically secured environments with restricted access controls
• Implement defense-in-depth by adding application-layer encryption for sensitive data stored on the device
• Consider network segmentation to limit exposure if disk contents were to be compromised
• Evaluate the use of additional hardware security modules or encrypted storage solutions independent of TPM-backed LUKS

Physical security measures should be proportional to the sensitivity of the data and operational criticality of the industrial systems. Regular security assessments and physical penetration testing can help validate the effectiveness of implemented controls.