Loading vulnerability…
OS Command Injection in Moxa OnCell G3150A-LTE SMS Management
CVE-2026-111461 is an OS command injection vulnerability in the SMS management functionality of Moxa OnCell G3150A-LTE Series devices. When SMS management is enabled and configured, insufficient input validation allows a remote attacker with the required privileges to execute arbitrary operating system commands on the affected device.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary command execution on the affected device, potentially compromising its confidentiality, integrity, and availability. The execution privilege level and any privilege-escalation capability are not specified.
If you can’t patch tonight, do this now.
Disable SMS management where it is not required to remove the stated exploitation prerequisite. Where it must remain enabled, restrict access to the functionality and protect credentials or other authorization mechanisms used to manage it.
Patch, then assume compromise.
Apply applicable Moxa firmware updates as they become available. A fixed firmware version for CVE-2026-111461 is not specified in the available information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.