CVE-2026-109813 in AIG-302
Summary
by MITRE • 10/16/2026
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The identified vulnerability represents a critical failure in cryptographic implementation within specific industrial computing devices manufactured by Moxa, specifically affecting the binary located at /usr/bin/sysman. This flaw is classified as CWE-798: Use of Hard-coded Credentials, where sensitive authentication or encryption material is embedded directly into the source code or compiled binary rather than being generated dynamically or stored in a secure hardware module. The presence of this hard-coded cryptographic key means that any entity capable of accessing the device's file system can extract the private key material without needing to bypass access controls or exploit additional logic flaws. This static nature of the credential eliminates the possibility of rotating keys through standard administrative procedures, as every instance of the vulnerable software contains the identical secret value.
From an operational perspective, this vulnerability poses a severe risk to both confidentiality and integrity within industrial control systems that rely on these devices for secure communication. An unauthenticated attacker positioned with adjacent network access can leverage the extracted private key to perform man-in-the-middle attacks or decrypt intercepted traffic. In many industrial protocols, such as Modbus TCP or proprietary Moxa communications, encryption is often used to protect command and control signals from tampering. By possessing the valid private key, an adversary can not only eavesdrop on sensitive operational data but also forge authenticated messages that appear legitimate to other system components. This capability allows for potential manipulation of industrial processes, leading to physical damage or safety hazards in critical infrastructure environments where these devices are deployed.
The attack vector aligns with MITRE ATT&CK technique T1552.004: Unsecured Credentials, specifically the sub-technique involving private keys found on local systems. The requirement for adjacent network access indicates that while remote exploitation over the public internet may not be directly possible without further pivoting or initial foothold, the risk remains high in segmented industrial networks where attackers might gain proximity through compromised endpoints or physical access to LAN segments. Once the key is obtained, it can be used indefinitely unless all affected devices are patched and keys are rotated across the entire fleet, a process that is complicated by the hard-coded nature of the flaw.
Mitigation strategies must focus on immediate isolation and long-term remediation. Organizations should immediately segment vulnerable Moxa industrial computing products from untrusted network zones to limit adjacent access opportunities. Network monitoring tools should be configured to detect anomalies in encrypted traffic patterns or unauthorized authentication attempts that might indicate key compromise. Furthermore, it is imperative to apply vendor-provided firmware updates if available, which typically replace the hard-coded keys with dynamically generated ones or integrate hardware security modules for key storage. In cases where patches are not immediately available, strict access control lists and firewall rules restricting communication to only known trusted IP addresses can reduce the attack surface until a permanent fix is implemented.