Moxa OnCell G3150A-LTE CVE-2026-111461

Exploitation requires that the SMS management functionality on the OnCell G3150A-LTE gateway is both enabled and configured - this is the specific feature/configuration prerequisite named in the description and reflected by AT:P in the CVSS 4.0 vector; if SMS management is disabled, the attack surface is absent. Additionally, per PR:H the attacker must already possess high (administrative) privileges on the device, which is the primary limiting factor and means this is not a pre-authentication remote takeover. No user interaction is required (UI:N) and the vector is network-reachable (AV:N). The strongest realistic limits are therefore: the non-default SMS feature must be active, and the attacker must already be authenticated at an administrative level. Fixed versions are not stated in the available sources; verify remediation against the vendor advisory for this specific product.

This is a genuine but conditional risk rather than a mass-exploitation emergency, and the signals are consistent in pointing to that conclusion. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, VC/VI/VA:H) describes a network-reachable command-injection with full confidentiality, integrity and availability impact on the device, but it is gated by two real constraints: PR:H means the attacker must already hold high (administrative) privileges, and AT:P indicates a specific attack requirement - here, that the SMS management functionality is enabled and configured. EPSS is 1.37% (72nd percentile), modest and roughly in line with a flaw that is serious but not trivially or widely exploited. The vuln.today decision label is 'monitor' (not act_now/emergency), and there is no CISA KEV listing and no public exploit reference, so there is no evidence of active exploitation. The practical read: a high-impact device-takeover bug on an industrial cellular gateway that is meaningfully blunted by requiring existing high privileges plus a non-default feature being enabled. Prioritize patching on exposed/managed OnCell gateways, but the combination of PR:H, AT:P, 'monitor' label and low-moderate EPSS argues this is a scheduled-remediation item, not a drop-everything one. Note one data caveat below regarding the linked advisory.

An attacker who has already obtained administrative (high-privilege) access to a Moxa OnCell G3150A-LTE gateway that has the SMS management feature enabled submits crafted input to that feature, where insufficient input validation allows the input to be interpreted as OS commands. The injected commands execute on the device, giving the attacker full control. No public exploit code or PoC reference is provided in the available sources, and no user interaction is required (UI:N).