Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-9266

AI Predicted 5.3 Difficulty: Trivial EPSS 0.07% · P0

Affected Version Matrix 1

VendorProductVersion RangeStatus
MoxaUC-1200A Series1.0≤ 1.4affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-9266

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
缺少必要的密码学步骤
Source: CVE Program / CVE List V5
Vulnerability Title
Moxa UC-1200A Series 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Moxa UC-1200A Series是中国Moxa公司的一个工业路由器。 Moxa UC-1200A Series 1.0版本至1.4版本存在安全漏洞，该漏洞源于缺少必需的加密步骤且CVE-2026-0714修复不完整，授权会话配置存在遗漏导致参数加密无效，具有物理访问权限的攻击者可捕获SPI总线上的TPM通信并明文导出LUKS磁盘加密密钥，导致加密磁盘卷完全被破解。此攻击需要侵入性物理访问，无法远程利用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
MoxaUC-1200A Series 1.0 ~ 1.4 -

II. Public POCs for CVE-2026-9266

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9266

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-9266 (1)

IV. Related Vulnerabilities

Same product: UC-1200A Series
Same vendor: Moxa
Same weakness: CWE-325

V. Comments for CVE-2026-9266

No comments yet

Leave a comment