{"id":"CVE-2026-111461","kind":"vulnerability","aliases":["CVE-2026-111461"],"related":[],"title":"OnCell G3150A-LTE: OS command injection via SMS management lets remote attackers run commands","description":"An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.","summary":"The OnCell G3150A-LTE industrial cellular gateway has an OS command injection flaw in its SMS management feature. A remote attacker with the required privileges can run arbitrary commands on the device.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cellular-gateway","industrial-iot","infrastructure","oncell-g3150a-lte"],"not_affected_if":["sms-management-disabled"],"how_to_check":"- Check whether SMS management is enabled and configured in the device web console; the sources do not give the menu path.\n- Compare the device firmware version against the vendor advisory: unknown.","fix":"- Apply the vendor firmware update that fixes CVE-2026-111461: unknown fixed version.\n- Disable SMS management if it is not needed: unknown, the sources do not give the setting name.","status":"open","published_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:46+00:00","triaged_at":"2026-10-27T08:32:32+00:00","updated_at":"2026-10-27T08:32:32+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T08:32:32Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the vendor firmware update that fixes CVE-2026-111461: unknown fixed version.\n- Disable SMS management if it is not needed: unknown, the sources do not give the setting name.","reach":"network","title":"OnCell G3150A-LTE: OS command injection via SMS management lets remote attackers run commands","impact":"high","summary":"The OnCell G3150A-LTE industrial cellular gateway has an OS command injection flaw in its SMS management feature. A remote attacker with the required privileges can run arbitrary commands on the device.","category":"infrastructure","nicknames":[],"who_cares":["oncell-g3150a-lte","industrial-iot","cellular-gateway"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary operating system commands on the gateway device.","analyst_note":"Find the vendor advisory and fixed firmware version for CVE-2026-111461 on the Moxa site; NVD gives no fix or check details.","how_to_check":"- Check whether SMS management is enabled and configured in the device web console; the sources do not give the menu path.\n- Compare the device firmware version against the vendor advisory: unknown.","needs_analyst":true,"not_affected_if":["sms-management-disabled"],"who_is_affected":"Only devices where the SMS management functionality is enabled and configured are described as exposed. The attacker must hold the privileges the sources call required, and the sources do not say which privileges. Teams that run OnCell G3150A-LTE gateways with SMS management turned off can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00062,"input_tokens":3301,"output_tokens":580,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111461':18A,21A '-2026':17A,20A 'affect':110C 'arbitrari':61B,106C 'attack':13A,54B,89C 'cellular':23B,39B 'cellular-gateway':22B 'command':6A,15A,44B,62B,68C,107C 'configur':86C 'could':94C 'cve':16A,19A 'devic':65B,111C 'enabl':84C 'execut':105C 'exist':71C 'exploit':95C 'featur':51B 'flaw':46B 'function':82C,103C 'g3150a':3A,31B,36B,75C 'g3150a-lte':2A,35B,74C 'gateway':24B,40B 'industri':26B,38B 'industrial-iot':25B 'infrastructur':28B 'inject':7A,45B,69C 'input':97C 'insuffici':96C 'iot':27B 'let':11A 'lte':4A,32B,37B,76C 'manag':10A,50B,81C,102C 'oncel':1A,30B,34B,73C 'oncell-g3150a-lte':29B 'os':5A,43B,67C 'privileg':58B,93C 'remot':12A,53B,88C 'requir':57B,92C 'run':14A,60B 'seri':77C 'sms':9A,49B,80C,101C 'valid':98C 'via':8A 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Only devices where the SMS management functionality is enabled and configured are described as exposed. The attacker must hold the privileges the sources call required, and the sources do not say which privileges. Teams that run OnCell G3150A-LTE gateways with SMS management turned off can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T08:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@moxa.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111461","severity":null,"published_at":"2026-10-27T08:16:53+00:00","modified_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:46+00:00","fetched_at":"2026-10-27T08:31:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}