An attacker who can physically tamper with a Moxa industrial computer that uses TPM‑backed LUKS full‑disk encryption can capture communications on the TPM SPI bus. By intercepting these messages over an extended period, the attacker may recover the encryption keys used to protect the eMMC and subsequently decrypt stored data. The vulnerability is a remote‑audience, offline cryptographic key recovery attack that results in disclosure of all data on the encrypted storage device. The weakness corresponds to CWE‑319, improper handling of compromised key material.

The flaw affects Moxa industrial computers, notably the UC‑1200A Series and several other Moxa model families listed in the CPE data. No specific firmware or hardware revision is disambiguated by the advisory; the advisory applies broadly to all devices that employ the exposed TPM‑backed LUKS configuration.

The CVSS score is 7.0, indicating a high‑severity flaw, but the low EPSS (<1 %) and lack of a KEV listing suggest that exploitation is currently unlikely in the wild. The highest risk comes from the need for extended physical access: an attacker must possess the device, open its enclosure, and attach specialized equipment to capture TPM traffic over the SPI bus. Remote exploitation is impossible. Given the physical nature of the attack, the feasibility is heavily constrained to scenarios where an adversary can allocate time and equipment to monitor the bus, making this a non‑immediate threat for most operators, but it remains a serious security concern for environments where devices might be left unattended or in vulnerable locations.