Moxa OnCell G3150A-LTE CVE-2026-111460

The decisive precondition, stated in the description, is that the target OnCell G3150A-LTE device must still be using its original hard-coded cryptographic key material and must NOT have regenerated its keys - devices that have rotated/regenerated keys are not impersonable this way. The CVSS vector adds two limiting factors: AT:P means a specific attack requirement must hold (e.g. the attacker must be able to use the shared key material in the management communication path), and UI:P means passive user interaction is involved rather than none. Exploitation is remote and unauthenticated (PR:N), but its realistic scope is bounded to fielded units left on factory keys and to attackers able to reach management communications; the precise trigger mechanics beyond 'obtain and reuse the shared key' are not detailed in the available sources.

Signals point consistently to a moderate, non-urgent priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, VC:H/VI:H/VA:H) scores 7.7 (High) and indicates an unauthenticated remote reach, but it carries two dampeners the base score already reflects: AT:P (a specific attack requirement must be met) and UI:P (passive user interaction is involved), meaning exploitation is not a clean fire-and-forget remote action. EPSS is low at 0.30% (23rd percentile), there is no CISA KEV listing, and no public exploit or PoC reference is present in the input - all three agree with the vendor-ecosystem 'monitor' decision label. CWE-321 (hard-coded cryptographic key) combined with the description shows the true precondition: the attack only works against devices that have NOT regenerated their cryptographic keys, i.e. units still relying on factory/default key material, which narrows the realistically exploitable population. No signals conflict here: a High-severity CVSS sits alongside uniformly low real-world-exploitation indicators, so this is better treated as a 'patch in normal cycle / regenerate keys' item than an emergency. One caveat to verify: the single vendor advisory URL is titled for the Moxa Remote Connect Suite (MRC) Client, while the described product, CPE, and EUVD affected-version entry are all the OnCell G3150A-LTE Series - confirm the correct product scope with Moxa.

An attacker who knows the hard-coded cryptographic key shipped in the OnCell G3150A-LTE Series targets a deployed gateway that still uses its original, un-regenerated keys. Using that shared key material the attacker impersonates the device during management communications, allowing them to read and tamper with that traffic (confidentiality and integrity impact). No public exploit code or PoC reference is identified in the available data, and the attack depends on an attack requirement (AT:P) and passive user interaction (UI:P) per the CVSS vector.