CVE-2026-109813

Shared Hard-coded Root CA Private Key

State: Published
Severity: 8.6 High
Published: Oct 16, 2026
Updated: Oct 16, 2026
Reserved: Oct 13, 2026

Description

A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	Moxa

Weaknesses

CWE-321 Use of Hard-coded Cryptographic Key

Affected Products

Product	Versions
AIG-302 SeriesMoxa	1.0.0 through 1.4.0Affected 1.4.1Not affected

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-2026-109812,-cve-2026-109813-vulnerabilities-in-industrial-computing-productsvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.