Executive Summary

CVE-2026-9266 is a Missing Required Cryptographic Step vulnerability in Moxa's embedded Linux firmware for industrial computers and controllers. It is an incomplete fix of a previous vulnerability (CVE-2026-0714) where TPM2 parameter encryption was introduced but improperly configured, making the encryption ineffective. An attacker with invasive physical access to the device can intercept TPM communications on the SPI bus and extract the LUKS disk encryption key in plaintext, leading to full compromise of the encrypted disk volume.

The attack requires physical access to the device, including opening it and attaching external equipment to the SPI bus. Remote exploitation is not possible.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker with physical access to fully compromise the encrypted disk volume by extracting the disk encryption key in plaintext. This means sensitive data stored on the device could be accessed and potentially stolen or manipulated.

However, exploitation requires invasive physical access, such as opening the device and connecting to the SPI bus, so remote attacks are not possible.

To mitigate the risk, physical access to devices should be restricted, and security best practices like network segmentation, strong authentication, and regular firmware updates should be implemented.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires invasive physical access to the device and involves capturing TPM communications on the SPI bus. It cannot be detected through network commands or remote system scans.

No specific detection commands or network-based detection methods are provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the updated firmware images released by Moxa that address this vulnerability.

• Restrict physical access to the affected devices to prevent invasive attacks.
• Implement general security best practices such as network segmentation and strong authentication.
• Regularly update device firmware to ensure all security patches are applied.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker with invasive physical access to extract the LUKS disk encryption key in plaintext, leading to full compromise of the encrypted disk volume.

Such a compromise of encrypted data could potentially impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data through effective encryption and access controls.

However, exploitation requires physical access and invasive actions, and remote exploitation is not possible.

Mitigation includes restricting physical access and applying firmware updates, which are important for maintaining compliance with security best practices mandated by these regulations.

Useful 0 Not Useful 0