CVE-2026-109812: Moxa Industrial Computing Information Leak

CVE-2026-109812 is an information disclosure flaw in Moxa industrial computing products that exposes sensitive data through an internal API. Low-privileged attackers can access cryptographic keys and confidential information. This article covers technical details, affected versions, impact assessment, and mitigation steps.

CVE-2026-109812 Overview

CVE-2026-109812 is a missing authorization vulnerability [CWE-862] affecting the internal /api/v1/secrets/ endpoint in several Moxa industrial computing products. A low-privileged authenticated attacker on an adjacent network can query the endpoint to retrieve sensitive information, including cryptographic key material. The flaw stems from the API failing to enforce authorization checks before returning secret data to any authenticated caller.

Critical Impact
Disclosure of confidential data and cryptographic key material from Moxa industrial computing products via an unprotected internal secrets API.

Affected Products

Moxa industrial computing products listed in Moxa Security Advisory MPSA-262560

Discovery Timeline

2026-10-16 - CVE-2026-109812 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109812

Vulnerability Analysis

The vulnerability resides in the internal REST endpoint /api/v1/secrets/ exposed by affected Moxa industrial computing products. The endpoint returns stored secret material to any authenticated session, regardless of the caller's role or privilege level. Authentication alone acts as the gate, with no subsequent authorization check binding the request to an authorized identity or scope.

An attacker with any valid low-privilege account on the device can invoke the endpoint and read secrets the account should not access. The disclosed data can include cryptographic keys used for device identity, communications, or integrations. Recovered key material can then be used to impersonate the device, decrypt captured traffic, or pivot into other systems that trust those keys.

Because the attack vector is adjacent, exploitation requires the attacker to be on the same logical network segment as the device, such as an operational technology (OT) VLAN. In flat or weakly segmented industrial networks, this condition is often trivial to satisfy.

Root Cause

The root cause is a missing authorization check [CWE-862] on an API that handles secret material. The handler treats all authenticated principals as trusted consumers of /api/v1/secrets/ instead of restricting access to privileged administrative roles.

Attack Vector

Exploitation requires adjacent network access and a valid low-privilege credential. The attacker authenticates to the device, issues an HTTP request to the /api/v1/secrets/ endpoint, and parses the response for cryptographic keys and other confidential values. No user interaction is required. Refer to the Moxa Security Advisory MPSA-262560 for product-specific exploitation conditions.

Detection Methods for CVE-2026-109812

Indicators of Compromise

HTTP requests to the /api/v1/secrets/ path originating from non-administrative accounts or unexpected source hosts.
Successful 200 OK responses to /api/v1/secrets/ requests from low-privileged user sessions.
Authentication events from low-privilege accounts followed immediately by secret-API access on the same session.

Detection Strategies

Enable verbose API access logging on affected Moxa devices and forward logs to a centralized SIEM for correlation.
Build detections that flag any access to /api/v1/secrets/ by non-administrative principals.
Baseline normal administrative access patterns and alert on deviations, such as access from unusual hours or hosts.

Monitoring Recommendations

Monitor north-south and east-west traffic on OT segments for unexpected HTTP calls to Moxa management APIs.
Track authentication activity on industrial devices and alert on brute-force or credential-stuffing patterns against low-privilege accounts.
Rotate and monitor usage of cryptographic keys that may have been exposed through the vulnerable endpoint.

How to Mitigate CVE-2026-109812

Immediate Actions Required

Apply the vendor-provided updates referenced in Moxa Security Advisory MPSA-262560 as soon as they are available for your product and firmware line.
Rotate all cryptographic keys and secrets stored on affected devices, assuming prior exposure.
Audit existing user accounts on affected devices and remove unused or low-privilege accounts that are not required.

Patch Information

Moxa has published advisory MPSA-262560 covering CVE-2026-109812 and CVE-2026-109813. Consult the advisory for the list of affected models, fixed firmware versions, and upgrade instructions: Moxa Security Advisory MPSA-262560.

Workarounds

Restrict management-plane access to affected devices using network segmentation, firewall rules, and dedicated management VLANs.
Enforce strong, unique credentials and the principle of least privilege for all device accounts.
Place affected devices behind a jump host or bastion that enforces additional authorization controls, until patches are deployed.