Vulnerability · Published Oct 27, 2026 · Assigned by Moxa
CVE-2026-111461SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series
High 7.5
In plain English
A high-severity OS command injection in OnCell G3150A-LTE Series from Moxa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).
Severity (CVSS 4.0)7.5High
Exploit odds (30 days)1.4%top 28.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Moxa | OnCell G3150A-LTE Series | 1.0.0 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N