Home / Items
Industrial control advisorySeverity 8.1 high
Moxa AIG-302 ThingsPro Edge
ICSA-26-293-03 · CISA · October 20, 2026
Summary
Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information.
From CISA, quoted as published. Check the source before acting.
What to do
Moxa has provided a fix for the vulnerability in v1.4.1. Users are encouraged to obtain and apply the update through one of the following methods:
If the AIG-302 has Internet access, login to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update.
Users can download the v1.4.1 patch manually from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch.
For more information refer to Moxa's security advisory MPSA-262560
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-109812 | 6.8 medium | No | 0.1% |
| CVE-2026-109813 | 8.1 high | No | 0.2% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Moxa | Moxa AIG-302 ThingsPro Edge firmware |
Why it's on these mode pages
- Maritime: Vendor table: Moxa (network and remote-access gear used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Moxa (network and remote-access gear used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Moxa (network and remote-access gear used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Moxa (network and remote-access gear used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Moxa (network and remote-access gear used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Moxa (network and remote-access gear used in every mode, all modes) (matched by rule)
Change history
- October 20, 2026: Initial Publication
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com