Moxa MRC Client and OnCell LTE devices hit by three flaws
Canada's Cyber Centre says MRC Client through v4.2.0 and all OnCell G3150A-LTE firmware are affected, with fixes not named.
46
CVE-2026-111461
OS command injection in Moxa OnCell G3150A-LTE SMS management
- CVSS 4.0
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An OS command injection flaw in the OnCell G3150A-LTE Series stems from insufficient input validation in SMS management. A remote attacker who already has high privileges can send crafted input when SMS management is enabled and configured, and run arbitrary commands on the device. Only those industrial LTE units with that feature turned on are affected.
What to do: Apply Moxa's update for CVE-2026-111461. No workaround is named; SMS management must be enabled for the issue to apply.
| Product | Affected |
|---|---|
| Moxa OnCell G3150A-LTE Series | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.
- Weakness
- CWE-78
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X