Oncell G3150A Lte Series
Monthly
Authenticated OS command injection in the Moxa OnCell G3150A-LTE cellular gateway (version 1.0.0 recorded as affected) lets a remote attacker who already holds administrative privileges on the device execute arbitrary commands by abusing insufficient input validation in the SMS management feature. The attack surface only exists when SMS management is enabled and configured, and the assessed CVSS 3.1 vector (7.5, AV:N/AC:L/PR:H/UI:N) confirms high privileges are required, so this is not a pre-authentication remote takeover. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 1.37% (72nd percentile) and the priority label is monitor, consistent with a conditional rather than mass-exploitation risk.
Impersonation of Moxa OnCell G3150A-LTE Series devices still using factory hard-coded keys is possible for unauthenticated remote attackers who obtain the shared key material, compromising confidentiality and integrity of management communications. EUVD lists version 1.0.0 as affected, and exposure is bounded to units that have not regenerated their cryptographic keys and to attackers able to meet the specific attack precondition and passive user interaction reflected in the assessed vector. No public exploit identified at time of analysis; EPSS is 0.30% (23rd percentile) and the priority is monitor.
Authenticated OS command injection in the Moxa OnCell G3150A-LTE cellular gateway (version 1.0.0 recorded as affected) lets a remote attacker who already holds administrative privileges on the device execute arbitrary commands by abusing insufficient input validation in the SMS management feature. The attack surface only exists when SMS management is enabled and configured, and the assessed CVSS 3.1 vector (7.5, AV:N/AC:L/PR:H/UI:N) confirms high privileges are required, so this is not a pre-authentication remote takeover. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 1.37% (72nd percentile) and the priority label is monitor, consistent with a conditional rather than mass-exploitation risk.
Impersonation of Moxa OnCell G3150A-LTE Series devices still using factory hard-coded keys is possible for unauthenticated remote attackers who obtain the shared key material, compromising confidentiality and integrity of management communications. EUVD lists version 1.0.0 as affected, and exposure is bounded to units that have not regenerated their cryptographic keys and to attackers able to meet the specific attack precondition and passive user interaction reflected in the assessed vector. No public exploit identified at time of analysis; EPSS is 0.30% (23rd percentile) and the priority is monitor.