Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-109813 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-2026-109812,-cve-2026-109813-vulnerabilities-in-industrial-computing-products	[email protected]	AdvisoryBundleRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-321	Use of Hard-coded Cryptographic Key	[email protected]

Affected Products

Product	Versions
Moxa AIG-302	<v1.4.1 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: v1.4.1moderate efforthttps://www.moxa.com/en/products/industrial-computing/iiot-gateways/programmable-iiot-gateways/aig-302-series#resources If the AIG-302 has Internet access: Log in to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update. Download the v1.4.1 patch manually: Download the patch from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch.

Product

Versions

Moxa AIG-302

<v1.4.1 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: v1.4.1moderate efforthttps://www.moxa.com/en/products/industrial-computing/iiot-gateways/programmable-iiot-gateways/aig-302-series#resources
If the AIG-302 has Internet access: Log in to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update. Download the v1.4.1 patch manually: Download the patch from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 16, 2026	CVE Modified	CISA-ADP
Oct 16, 2026	New CVE Received	[email protected]