CVE-2026-111461: SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series

Severity: high (CVSS 7.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-27 · updated 2026-10-27
Weakness: CWE-78

Description

An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.

Affected products

Moxa OnCell G3150A-LTE Series: 1.0.0

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269510-cve-2026-111459-cve-2026-111460-cve-2026-111461-vulnerabilities-in-moxa-remote-connect-suite-mrc-client

Get alerted when CVE-2026-111461 or the next vulnerability affects your stack