CVE-2026-111461: high-severity vulnerability in Moxa OnCell G3150A-LTE Series
SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.4%
An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Moxa · OnCell G3150A-LTE SeriesRelated CVEs — Moxa OnCell G3150A-LTE Series
In the same product, most dangerous first.
CVE-2024-4639HIGHOnCell G3470A-LTE Series: Authenticated Command Injection via webDelIPSecEPSS 0.4%CVE-2024-4640HIGHOnCell G3470A-LTE Series: Authenticated Command Injection via sendTestEmailEPSS 0.4%CVE-2024-4641MEDIUMOnCell G3470A-LTE Series: Authenticated Format String ErrorsEPSS 0.3%CVE-2026-111460HIGHStatic HTTPS private key and CA private key in firmware in OnCell G3150A-LTE SeriesEPSS 0.3%CVE-2023-6093MEDIUMOnCell G3150A-LTE Series: Clickjacking VulnerabilityEPSS 0.3%CVE-2023-6094MEDIUMOnCell G3150A-LTE Series: Web Server Transmits Cleartext CredentialsEPSS 0.2%