CVE-2026-109813: CWE-321: Use of Hard-coded Cryptographic Key in Moxa AIG-302 Series

This vulnerability arises from the use of a hard-coded cryptographic key in the /usr/bin/sysman binary of Moxa AIG-302 Series devices. The presence of this static key allows an attacker on the adjacent network to leverage the exposed private key material to undermine secure communications, potentially leading to unauthorized data disclosure or manipulation. The CVSS 4.0 base score is 8.6, reflecting high impact with low attack complexity and no required privileges or user interaction.

Exploitation of this vulnerability could lead to compromise of the confidentiality and integrity of communications handled by the affected devices. Since the attacker requires only adjacent network access and no authentication, this poses a significant risk to the security of industrial environments using these products.

No official patch or remediation has been provided yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict adjacent network access to the affected devices to trusted entities only and monitor for suspicious activity related to communications with the /usr/bin/sysman component.