CVE-2026-111461High· 7.5▾ TwilightAn OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
1.4%
An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.
oncell_g3150a-lte_series 1.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Please refer to the following mitigation measures to reduce the risk of exploitation:
For CVE-2026-111461, keep the SMS functionality disabled unless it is required for operation. This functionality is disabled by default. If it is not needed, Moxa recommends leaving it disabled to reduce the risk of exploitation.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111460High· 7.7Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series
CVE-2026-111459High· 7.6Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)
CVE-2026-111548Medium· 5.3A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers
CVE-2026-109813High· 8.6A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products
CVE-2026-109812Medium· 6.9A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products
CVE-2022-33186Critical· 9.8A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling …