LUKS Encryption Compromised on Linux ICS Devices via TPM Bus Sniffing Exploit
Security researchers have identified a critical vulnerability in the Moxa UC-1222A Secure Edition industrial computer. The issue involves the complete defeat of LUKS full-disk encryption by passively intercepting the SPI bus communication between the…
Security researchers have identified a critical vulnerability in the Moxa UC-1222A Secure Edition industrial computer. The issue involves the complete defeat of LUKS full-disk encryption by passively intercepting the SPI bus communication between the processor and the TPM 2.0 chip during system boot.
This vulnerability, identified as CVE-2026-0714, marks the first publicly documented TPM sniffing attack utilizing the TPM2_NV_Read command to release the disk decryption key, rather than the more commonly observed TPM2_Unseal command.
CVE ID Affected Product Platform Attack Vector Severity
CVE-2026-0714 Moxa UC-1222A Secure Edition Moxa Industrial Linux 3 Physical (SPI Bus) High
The Moxa UC-1222A is an ARM-based industrial computer designed for secure data acquisition and field-site deployments. It employs TPM 2.0 backed LUKS encryption. During boot, the device's SoC sends a TPM2_NV_Read command to retrieve the LUKS disk decryption key from the TPM's protected non-volatile index.
Security researchers have identified a critical vulnerability in the Moxa UC-1222A Secure Edition industrial computer.
The returned key material is transmitted in plaintext over the SPI bus without cryptographic session protection, allowing interception by a physically positioned attacker.
Researchers conducted tests using a Saleae Logic 8 logic analyzer connected to the TPM 2.0 chip's SPI pins. The analyzer recorded the boot sequence at 250 MS/s. Custom scripts parsed the SPI traffic to locate the TPM_CC_NV_Read command and extract the plaintext LUKS key from the MISO response.
They validated the recovered key by dumping the device's eMMC flash contents and mounting the encrypted partition using the intercepted passphrase.
This vulnerability highlights the potential risks in vendor-specific provisioning logic, as seen in this Linux ICS environment exploit.
Moxa acknowledged the issue and issued a security advisory on February 5, 2026. The Trusted Computing Group recommends mitigating such attacks through TPM parameter encryption, ensuring sensitive command and response parameters are protected.
CYLOQ has released an open-source Saleae plugin for automated NV_Read secret extraction, emphasizing the ease of interception for unprotected devices.
Organizations using Moxa UC-1222A Secure Edition in environments with uncontrolled physical access should prioritize addressing this vulnerability, especially in remote or industrial settings where hardware access could be prolonged.
Based on reporting by GBHackers.