---
id: CVE-2026-111460
title: >-
  Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE
  Series
summary: "A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices\_t…"
severity: high
cvss: 7.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-321
vendor: Moxa
product: OnCell G3150A-LTE Series
affected:
  - oncell_g3150a-lte_series 1.0.0
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T07:13:51.550Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111460'
references:
  - url: >-
      https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269510-cve-2026-111459-cve-2026-111460-cve-2026-111461-vulnerabilities-in-moxa-remote-connect-suite-mrc-client
tags:
  - cve.org
epss: 0.00301
epssPercentile: 0.2269
ingestedAt: '2026-10-27T16:11:59.235Z'
---

## Overview

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.

## Affected

- `oncell_g3150a-lte_series 1.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Please refer to the following mitigation measures to reduce the risk of exploitation:

  *  

For CVE-2026-111460, reset the affected device to regenerate the device certificate and associated cryptographic key material.