Aig 302 Series
Monthly
Hard-coded cryptographic key material embedded in the /usr/bin/sysman binary of Moxa's AIG-302 Series industrial computers enables an unauthenticated attacker who already sits on the same local or logical network segment to recover the static private key and use it to decrypt or tamper with the device's protected communications. The key is identical across all affected units and is trivially extractable by reverse-engineering shipped firmware, so the confidentiality and integrity of those communications are effectively compromised once an attacker reaches the industrial LAN; availability is unaffected and no public exploit code has been identified at time of analysis, with no confirmed active exploitation. The practical barrier is the required adjacent-network position rather than any credential or user interaction, making this a moderately high priority OT/ICS exposure rather than an internet-reachable mass-exploitation issue.
Missing authorization in the internal /api/v1/secrets/ REST API of Moxa's AIG-302 series industrial computing gateways lets an attacker who already holds a valid low-privileged session on the device read secrets and cryptographic key material directly from that endpoint. Exploitation requires two preconditions: pre-existing valid credentials (PR:L) and adjacent, Layer-2 network access to reach the internal API (AV:A), so the flaw is not reachable from the open internet or by unauthenticated users. Impact is confidentiality-only - high-value disclosure of stored credentials and key material - with no integrity or availability effect, giving a moderate severity rating (CVSS 4.0 base 6.9 / Medium); no public exploit code has been identified at time of analysis, and the issue is published alongside a related flaw, CVE-2026-109813, in Moxa advisory MPSA-262560.
Hard-coded cryptographic key material embedded in the /usr/bin/sysman binary of Moxa's AIG-302 Series industrial computers enables an unauthenticated attacker who already sits on the same local or logical network segment to recover the static private key and use it to decrypt or tamper with the device's protected communications. The key is identical across all affected units and is trivially extractable by reverse-engineering shipped firmware, so the confidentiality and integrity of those communications are effectively compromised once an attacker reaches the industrial LAN; availability is unaffected and no public exploit code has been identified at time of analysis, with no confirmed active exploitation. The practical barrier is the required adjacent-network position rather than any credential or user interaction, making this a moderately high priority OT/ICS exposure rather than an internet-reachable mass-exploitation issue.
Missing authorization in the internal /api/v1/secrets/ REST API of Moxa's AIG-302 series industrial computing gateways lets an attacker who already holds a valid low-privileged session on the device read secrets and cryptographic key material directly from that endpoint. Exploitation requires two preconditions: pre-existing valid credentials (PR:L) and adjacent, Layer-2 network access to reach the internal API (AV:A), so the flaw is not reachable from the open internet or by unauthenticated users. Impact is confidentiality-only - high-value disclosure of stored credentials and key material - with no integrity or availability effect, giving a moderate severity rating (CVSS 4.0 base 6.9 / Medium); no public exploit code has been identified at time of analysis, and the issue is published alongside a related flaw, CVE-2026-109813, in Moxa advisory MPSA-262560.