---
id: "CVE-2026-111460"
kind: "vulnerability"
aliases: ["CVE-2026-111460"]
title: "Moxa OnCell G3150A-LTE: hard-coded key lets attackers impersonate devices"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cellular-gateway", "industrial-iot", "infrastructure", "moxa", "ot-network"]
not_affected_if: ["keys-regenerated"]
published_at: "2026-10-27T08:16:53+00:00"
first_seen_at: "2026-10-27T08:31:46+00:00"
updated_at: "2026-10-27T08:32:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111460", "first_seen_at": "2026-10-27T08:31:46+00:00"}]
---

# Moxa OnCell G3150A-LTE: hard-coded key lets attackers impersonate devices

The OnCell G3150A-LTE industrial cellular gateway ships with shared cryptographic key material that is the same across devices. An unauthenticated remote attacker who obtains that key can impersonate affected devices and tamper with their management communications.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version on the device against the vendor advisory; unknown whether the sources list affected versions.
- Confirm whether the device's cryptographic keys have been regenerated since installation; unknown how the sources say to verify this.

## Fix

- Regenerate the device's cryptographic keys as the vendor advisory directs; unknown exact steps in the sources.
- Apply the vendor firmware update if one is listed; unknown which version fixes it.

## Timeline

- 2026-10-27T08:31:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111460

## From the sources

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_