Moxa MRC Client and OnCell LTE devices hit by three flaws
Canada's Cyber Centre says MRC Client through v4.2.0 and all OnCell G3150A-LTE firmware are affected, with fixes not named.
46
CVE-2026-111460
Hard-coded cryptographic key in Moxa OnCell G3150A-LTE
- CVSS 4.0
- 7.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The OnCell G3150A-LTE Series uses a hard-coded cryptographic key. Under certain conditions, an unauthenticated remote attacker can obtain shared key material and impersonate devices that have not regenerated their keys. That can compromise the confidentiality and integrity of management communications. Moxa has not listed affected builds or a fixed release.
What to do: Apply Moxa's update for CVE-2026-111460. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Moxa OnCell G3150A-LTE Series | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.
- Weakness
- CWE-321
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X