A missing cryptographic step in Moxa's embedded Linux firmware allows an attacker with invasive physical access to capture TPM communications on the SPI bus and recover the LUKS disk encryption key in plaintext. This flaw effectively disables the intended protection from prior CVE-2026-0714 mitigations, resulting in full compromise of the encrypted disk volume. The vulnerability is a CWE‑325 weakness in the authorization session configuration that omits required encryption.

Manufacturers using Moxa UC‑1200A Series industrial computers and controllers are affected. The vulnerability applies to all firmware revisions of the UC‑1200A Series that include the incomplete TPM2 parameter encryption implementation. No specific firmware version is listed, but all devices that ship with the referenced firmware configuration are impacted.

The severity score of 7 indicates a medium‑to‑high risk, and the attack requires invasive physical access such as opening the device and attaching equipment to the SPI bus. Remote exploitation is not feasible, and the flaw does not affect downstream systems. Because EPSS is not available and the flaw is not listed in CISA’s KEV catalog, the likelihood of widespread exploitation is uncertain, but the impact on affected devices is complete. Implementing the vendor’s fix and enforcing strict physical security are critical to mitigate this risk.