Moxa AIG-302 CVE-2026-109813

Exploitation requires adjacent network access (AV:A) - the attacker must be on the same local/logical network segment as the Moxa AIG-302 Series device (e.g., the industrial LAN), not the open internet, which is the primary limiting factor. No authentication, privileges, or user interaction are needed (PR:N/UI:N) once that network position is obtained. The attacker must obtain the hard-coded private key material embedded in /usr/bin/sysman - trivially recoverable by reverse-engineering the firmware of any affected unit since the key is static across devices - and then be positioned to intercept the target's communications to decrypt or tamper with them. Impact is limited to confidentiality and integrity of communications; there is no availability impact (VA:N).

This is a credible, moderately high-priority OT/ICS risk rather than an inflated high-CVSS issue, but it is tempered by access constraints. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) scores 8.6 and indicates an unauthenticated, low-complexity attack with no user interaction yielding high confidentiality AND integrity impact - consistent with CWE-321 (hard-coded cryptographic key), where a shared/static private key embedded in /usr/bin/sysman lets an attacker decrypt or forge protected communications. The key limiting signal is the Adjacent (AV:A) attack vector: the attacker must be on the same logical network segment (e.g., the local industrial LAN) rather than exploiting across the open internet, which meaningfully narrows the exposure to insiders, pivoted hosts, or anyone with access to the OT network. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization; the real-world probability of mass exploitation is currently low despite the high severity rating. Because hard-coded keys are typically identical across all units of an affected firmware line, the flaw is systemic (one extracted key compromises the whole fleet), which raises long-term risk if the key is ever published. Net: prioritize patching for exposed/flat OT networks, but treat widespread opportunistic exploitation as unlikely until key material or a POC surfaces.

An attacker with a foothold on the same industrial network segment as a Moxa AIG-302 gateway extracts the hard-coded private key from the sysman binary (or an identical unit's firmware) and uses it to passively decrypt intercepted traffic or actively machine-in-the-middle the device's communications, breaking confidentiality and tampering with integrity. No authentication or user interaction is required, but adjacent network positioning is. No public exploit identified at time of analysis, so an attacker would need to reverse-engineer the firmware themselves.