Moxa AIG-302 ThingsPro Edge

This advisory describes two vulnerabilities in Moxa AIG-302 ThingsPro Edge firmware (<=1.4.0): a missing authorization issue that can disclose sensitive data (including cryptographic keys) and a hard-coded cryptographic key in /usr/bin/sysman that exposes private key material. Both issues are fixed in v1.4.1 and users are advised to apply the update or follow provided mitigation guidance; the report notes these devices are used in critical infrastructure sectors and that no public exploitation has been reported.