CVE-2026-9266: A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers

Synopsis

A missing required cryptographic step vulnerability exists in Moxa's embedded Linux firmware for the UC-1200A Series industrial computers and controllers. The firmware attempted to remediate a prior vulnerability (CVE-2026-0714) by introducing TPM2 parameter encryption, but a misconfiguration in the authorization session renders that protection ineffective, allowing an attacker with invasive physical access to capture TPM communications over the SPI bus and recover the LUKS disk encryption key in plaintext. Successful exploitation results in full compromise of the encrypted disk volume. No fix version has been published; HarborGuard tracks this advisory and will make a patched rebuild available as soon as Moxa releases a corrected firmware.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  Physical proximity is required; the attacker must open the device and attach external equipment to the SPI bus, and remote exploitation is not possible.

• AuthenticationNot required

  No account credentials or software-level authentication are required; the attack is conducted at the hardware bus level before any OS authentication layer is reached.

• Victim interactionNot required

  No user action is needed; once the attacker has physical access to the opened device, the capture and key derivation proceed without any interaction from a legitimate user.

• Attack complexityDetail

  The exploit is condition-free once physical access is established, with no race conditions or unpredictable environmental factors required to capture and decode the TPM SPI traffic.

Blast Radius

• Reads the LUKS disk encryption key in plaintext, decrypting the full contents of the protected disk volume.
• Accesses all data stored on the device, including configuration files, credentials, and operational logs.
• Modifies firmware or persisted data on the disk, enabling persistent tampering with the industrial controller.