PT-2026-48857 · Moxa · Embedded Linux Firmware

Cyloq · CVE-2026-9266 · Published 2026-06-12 · Updated 2026-06-12

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moxa embedded Linux firmware for industrial computers and controllers (affected versions not specified)

Description A missing required cryptographic step exists in the embedded Linux firmware. This issue is an incomplete remediation of a previous flaw where TPM2 parameter encryption was introduced as a countermeasure. Due to an omission in the authorization session configuration, the parameter encryption is ineffective. An attacker with invasive physical access can capture TPM communications on the SPI bus to derive the LUKS disk encryption key in plaintext, leading to a full compromise of the encrypted disk volume. Remote exploitation is not possible.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-325

Related Identifiers

BDU:2026-08925

CVE-2026-9266

Affected Products

Embedded Linux Firmware

References · 6

• https://moxa.com/en/support/product-support/security-advisory/mpsa-266240-cve-2026-9266-missing-required-cryptographic-step-vulnerability-in-industrial-computers · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9266 · Security Note
• https://bdu.fstec.ru/vul/2026-08925 · Security Note
• https://twitter.com/CVEnew/status/2065461515096891512 · Twitter Post
• https://t.me/CVEtracker/56700 · Telegram Post
• https://t.me/cveNotify/167183 · Telegram Post