Moxa AIG-302 ThingsPro Edge through 1.4.0 can leak keys
An unauthenticated adjacent attacker can abuse a hard-coded key; a logged-in user can read the secrets API.
64
CVE-2026-109813
Hard-coded key in Moxa sysman (adjacent network)
- CVSS 4.0
- 8.6 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A hard-coded cryptographic key in /usr/bin/sysman on some Moxa industrial computing products exposes private key material. An unauthenticated attacker on an adjacent network can use it to break the confidentiality and integrity of communications. Availability is not affected. Moxa has not listed specific builds or fixed versions.
What to do: Apply Moxa's update for CVE-2026-109813. No workaround is stated.
| Product | Affected |
|---|---|
| Moxa industrial computing products (/usr/bin/sysman) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.
- Weakness
- CWE-321
- Vector
- CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
2 stories[Control Systems] Moxa security advisory (AV26-1055)
Canada's Cyber Centre warns Moxa AIG-302 versions through 1.4.1 have two newly listed vulnerabilities.
38