High severity · published Oct 27, 2026
CVE-2026-111461
SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series
New
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OG
OnCell G3150A-LTE Series · Moxa
1.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111461
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111461
www.moxa.com
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269510-cve-2026-111459-cve-2026-111460-cve-2026-111461-vulnerabilities-in-moxa-remote-connect-suite-mrc-client
More from OnCell G3150A-LTE Series
7.7
CVE-2026-111460
Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series