{"id":"CVE-2026-111460","kind":"vulnerability","aliases":["CVE-2026-111460"],"related":[],"title":"Moxa OnCell G3150A-LTE: hard-coded key lets attackers impersonate devices","description":"A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.","summary":"The OnCell G3150A-LTE industrial cellular gateway ships with shared cryptographic key material that is the same across devices. An unauthenticated remote attacker who obtains that key can impersonate affected devices and tamper with their management communications.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cellular-gateway","industrial-iot","infrastructure","moxa","ot-network"],"not_affected_if":["keys-regenerated"],"how_to_check":"- Check the firmware version on the device against the vendor advisory; unknown whether the sources list affected versions.\n- Confirm whether the device's cryptographic keys have been regenerated since installation; unknown how the sources say to verify this.","fix":"- Regenerate the device's cryptographic keys as the vendor advisory directs; unknown exact steps in the sources.\n- Apply the vendor firmware update if one is listed; unknown which version fixes it.","status":"open","published_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:46+00:00","triaged_at":"2026-10-27T08:32:29+00:00","updated_at":"2026-10-27T08:32:29+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T08:32:29Z","model":"claude-haiku-5-5","output":{"fix":"- Regenerate the device's cryptographic keys as the vendor advisory directs; unknown exact steps in the sources.\n- Apply the vendor firmware update if one is listed; unknown which version fixes it.","reach":"unknown","title":"Moxa OnCell G3150A-LTE: hard-coded key lets attackers impersonate devices","impact":"medium","summary":"The OnCell G3150A-LTE industrial cellular gateway ships with shared cryptographic key material that is the same across devices. An unauthenticated remote attacker who obtains that key can impersonate affected devices and tamper with their management communications.","category":"infrastructure","nicknames":[],"who_cares":["industrial-iot","moxa","cellular-gateway","ot-network"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker impersonates the device and tampers with its management communications.","analyst_note":"Find the Moxa security advisory for CVE-2026-111460 to confirm affected firmware versions, the key regeneration procedure, and the reachable management interfaces.","how_to_check":"- Check the firmware version on the device against the vendor advisory; unknown whether the sources list affected versions.\n- Confirm whether the device's cryptographic keys have been regenerated since installation; unknown how the sources say to verify this.","needs_analyst":true,"not_affected_if":["keys-regenerated"],"who_is_affected":"Teams running Moxa OnCell G3150A-LTE Series gateways whose cryptographic keys were never regenerated, so they still use the shared factory key material. Devices whose keys have been regenerated are described as not exposed by the sources. The sources do not say how management traffic is reached, so unknown whether internet-facing deployments are more exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":3332,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111460':16A,19A '-2026':15A,18A 'across':49B 'affect':61B,102C 'attack':11A,54B,90C 'cellular':21B,37B 'cellular-gateway':20B 'certain':85C 'code':8A,72C 'communic':68B,119C 'compromis':112C 'condit':86C 'confidenti':114C 'could':91C 'cryptograph':42B,73C,94C,109C 'cve':14A,17A 'devic':13A,50B,62B,103C 'exist':76C 'g3150a':4A,34B,81C 'g3150a-lte':3A,33B,80C 'gateway':22B,38B 'hard':7A,71C 'hard-cod':6A,70C 'imperson':12A,60B,101C 'industri':24B,36B 'industrial-iot':23B 'infrastructur':26B 'integr':116C 'iot':25B 'key':9A,43B,58B,74C,95C,110C 'let':10A 'lte':5A,35B,82C 'manag':67B,118C 'materi':44B,96C 'moxa':1A,27B 'network':30B 'obtain':56B,92C 'oncel':2A,32B,79C 'ot':29B 'ot-network':28B 'potenti':111C 'regener':107C 'remot':53B,89C 'seri':83C 'share':41B,93C 'ship':39B 'tamper':64B 'unauthent':52B,88C 'use':98C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Teams running Moxa OnCell G3150A-LTE Series gateways whose cryptographic keys were never regenerated, so they still use the shared factory key material. Devices whose keys have been regenerated are described as not exposed by the sources. The sources do not say how management traffic is reached, so unknown whether internet-facing deployments are more exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T08:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@moxa.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111460","severity":null,"published_at":"2026-10-27T08:16:53+00:00","modified_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:46+00:00","fetched_at":"2026-10-27T08:31:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}