CVE-2026-9266
Moxa Firmware Missing Required Cryptographic Step Vulnerability
Description
A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.
INFO
Published Date :
June 12, 2026, 11:16 a.m.
Last Modified :
Oct. 26, 2026, 11:10 a.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | 2e0a0ee2-d866-482a-9f5e-ac03d156dbaa | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Apply firmware updates from Moxa.
- Verify TPM2 parameter encryption implementation.
- Ensure secure authorization session configuration.
- Restrict physical access to devices.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-9266.
| URL | Resource |
|---|---|
| https://www.moxa.com/en/support/product-support/security-advisory/mpsa-266240-cve-2026-9266-missing-required-cryptographic-step-vulnerability-in-industrial-computers |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-9266 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-9266
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-9266 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-9266 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: UC-1200A Series de Moxa, Description: Una vulnerabilidad de Paso Criptográfico Requerido Faltante ha sido identificada en el firmware Linux embebido de Moxa para ordenadores y controladores industriales. Esta vulnerabilidad representa una remediación incompleta de CVE-2026-0714. El firmware introdujo el cifrado de parámetros TPM2 como contramedida contra CVE-2026-0714. Sin embargo, una omisión en la configuración de la sesión de autorización hace que el cifrado de parámetros no proporcione protección efectiva. Un atacante con acceso físico invasivo al dispositivo aún puede capturar comunicaciones TPM en el bus SPI y derivar la clave de cifrado de disco LUKS en texto plano. Si bien la explotación exitosa resulta en un compromiso total del volumen de disco cifrado, el ataque requiere acceso físico invasivo, incluyendo abrir el dispositivo y conectar equipo externo al bus SPI. La explotación remota no es posible, y el ataque no afecta a ningún sistema descendente. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Moxa', 'product': 'UC-1200A Series', 'versions': [{'status': 'affected', 'version': '1.0', 'versionType': 'custom', 'lessThanOrEqual': '1.4'}], 'platforms': ['OS image\xa0(MIL3 Secure version)'], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-9266', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-06-12T13:29:27.309419Z'} -
New CVE Received by [email protected]
Jun. 12, 2026
Action Type Old Value New Value Added Description A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems. Added CVSS V4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-325 Added Reference https://www.moxa.com/en/support/product-support/security-advisory/mpsa-266240-cve-2026-9266-missing-required-cryptographic-step-vulnerability-in-industrial-computers