A hard‑coded cryptographic key was embedded in the /usr/bin/sysman utility on some Moxa industrial computing devices. Because the private key material is not protected, an attacker can extract it and use it to decrypt, modify or forge traffic that relies on the corresponding certificates. The resulting breach allows the attacker to read confidential data, tamper with messages, and potentially insert unauthorized commands, thereby undermining both confidentiality and integrity of network communications.

The vulnerability affects Moxa AIG‑302 Series industrial controllers, specifically firmware version 1.4.1 and potentially earlier releases that contain the same /usr/bin/sysman binary. Devices using this firmware should be verified against the affected CPE identifiers.

The CVSS score of 8.6 classifies this flaw as High severity, indicating significant impact if exploited. The EPSS score of 0.153% indicates a very low probability of exploitation, but the flaw can still be leveraged by an unauthenticated attacker who has adjacent network access, which is a common scenario in industrial environments. The vulnerability is not listed in the CISA KEV catalog, but the potential for widespread compromise makes immediate remediation advisable.