Moxa AIG-302 Series: Hard-coded cryptographic key in sysman
Summary
The AIG-302 Series industrial IIoT gateways from Moxa ship with a hard-coded root CA private key in /usr/bin/sysman. An unauthenticated attacker with adjacent network access can use the exposed key to compromise the confidentiality and integrity of communications. According to CISA, the flaw is not remotely exploitable and no public exploitation is known.
Affected
- Moxa AIG-302 Series firmware 1.0.0 through 1.4.0 (inclusive)
Fixed in
- Firmware v1.4.1
Workaround
- No vendor workaround is listed. Moxa points only to the v1.4.1 patch.
- Until patched, keep devices off untrusted and public networks and restrict adjacent access to management and OT segments.
Exploitation
- CISA reports no known public exploitation of these flaws (per a secondary summary of CISA information; not verified on the CISA page).
- No public proof of concept found. This does not prove none exists.
- Not listed in CISA KEV as far as found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Inventory all AIG-302 devices and confirm firmware versions in the web console.
- Update devices at 1.4.0 or lower to v1.4.1 using the package from Moxa's official sources (Maintenance > Software Upgrades).
- Confirm that no AIG-302 is reachable from untrusted networks and restrict adjacent access to OT segments.
- Ask Moxa whether keys or certificates generated on the old firmware must be rotated after patching.
- Handle CVE-2026-109812 in the same change window and monitor Moxa's advisory and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Moxa Security Advisory MPSA-262560 www.moxa.com
- CISA ICS Advisory ICSA-26-293-03 www.cisa.gov
- Vulners CVE record (CVELIST) vulners.com
- VulDB CVE-2026-109813 vuldb.com
- Security Boulevard OT security news, October 22 2026 securityboulevard.com
- Moxa AIG-302-T-AZU-LX product page www.moxa.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:55.
Original description (NVD)
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.