Live › vulnerability › CVE-2026-109812
Go to dashboardSome Moxa industrial computing products expose an internal API endpoint at /api/v1/secrets/ without an authorization check. An authenticated low-privileged user on an adjacent network can read sensitive data, including cryptographic key material.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Operators running Moxa industrial computing products on a network where low-privileged accounts or adjacent-network access exist. Sites with no Moxa industrial computers, or with only fully trusted local users and isolated networks, can likely skip it. The sources do not list affected models or firmware versions.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.
This page as .md · .json · in your agent: get_signal("CVE-2026-109812")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.