noindex and left out of the sitemap until more data is confirmed.CVE-2026-109813 is a hard-coded cryptographic key in the /usr/bin/sysman component of Moxa's AIG-302 industrial computing products, exposing private key material that an unauthenticated attacker with adjacent network access can use to compromise the confidentiality and integrity of device communications; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.1%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-16
Published
Vulnerability ID: CVE-2026-109813 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Moxa AIG-302 Series (ThingsPro Edge firmware) | — | firmware <= v1.4.0 (fixed in v1.4.1, per Moxa Advisory MPSA-262560); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-109813 is a use of a hard-coded cryptographic key (CWE-321) in the /usr/bin/sysman component of Moxa's AIG-302 Series industrial computing products running ThingsPro Edge firmware. NVD's description states "an unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications" (NVD).
NVD tracks the CVE with status "Deferred" as of 2026-10-21: it records Moxa's own CNA-submitted CVSS v4.0 score of 8.6 (high), vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N, but has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting Moxa's figure as NVD-confirmed (NVD).
Moxa's own advisory MPSA-262560, published 2026-10-16, confirms AIG-302 Series firmware v1.4.0 and earlier is affected, scores the issue 8.6 (high), and lists a second, related flaw disclosed in the same advisory — CVE-2026-109812, a missing-authorization bug in the internal /api/v1/secrets/ API (6.9, medium); both are fixed in firmware v1.4.1, available through the AIG-302 web console (Maintenance > Software Upgrades) or Moxa's Software Release Service (Moxa Advisory MPSA-262560).
Exploitation requires adjacent network access (CVSS vector AV:A) rather than being reachable from the open internet; CISA's corresponding ICS advisory reports no known public exploitation of either CVE (CISA ICS Advisory ICSA-26-293-03).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-21, and FIRST scores the probability of exploitation at 0.0015 (4.1th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, AIG-302 operators should upgrade to firmware v1.4.1 and restrict adjacent-network access to the device per Moxa's standard network segmentation guidance.
Evidence
- Hard-coded private key in /usr/bin/sysman lets an unauthenticated, adjacent-network attacker compromise confidentiality and integrity of device communications (CWE-321). — NVD
- NVD status is "Deferred" with Moxa-submitted CVSS v4.0 8.6, no NVD-published score or CPE configuration as of 2026-10-21. — NVD
- Affects AIG-302 Series firmware v1.4.0 and earlier, fixed in v1.4.1; disclosed alongside related CVE-2026-109812 in Moxa Advisory MPSA-262560. — Moxa Advisory MPSA-262560
- Not present in the CISA KEV catalog as of 2026-10-21. — CISA KEV
- EPSS score is 0.0015 (4.1th percentile) as of 2026-10-21. — FIRST EPSS
