Loading vulnerability…
Hard-coded Cryptographic Key in Moxa OnCell G3150A-LTE Series
CVE-2026-111460 is a hard-coded cryptographic key vulnerability in the Moxa OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker can obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys. Successful exploitation can compromise the confidentiality and integrity of management communications. The precise key-recovery mechanism and vulnerable functions are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker could impersonate an affected device using shared cryptographic key material, potentially exposing management communications or allowing their falsification. The identified impact concerns the confidentiality and integrity of management communications; arbitrary code execution and availability impacts are not established.
If you can’t patch tonight, do this now.
Regenerate cryptographic keys on affected devices using vendor-supported procedures so that they no longer rely on the shared hard-coded key material.
Patch, then assume compromise.
Apply applicable Moxa security updates as they become available and follow vendor guidance for replacing or regenerating affected cryptographic keys. A fixed firmware version and the precise key-regeneration procedure are not specified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.