Oncell G3150a-lte Series CVEs and Security Vulnerabilities

CVE-2026-111461

SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series

An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.

CVSS 4.0 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Moxa

Products

Oncell G3150a-lte Series

CVE-2026-111460

Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed