Moxa Warns of Three Flaws in MRC Client and End-of-Life OnCell G3150A-LTE Gateway
Do Son 
TL;DR
Moxa published advisory MPSA-269510 covering three Moxa vulnerabilities, all rated high severity. One affects the Remote Connect Suite (MRC Client), and two hit the end-of-life OnCell G3150A-LTE cellular gateway. MRC Client users can get a patch, but OnCell owners must rely on mitigations.
- Product: Moxa (2 products)
- Vulnerabilities: 3 flaws (CVE-2026-111459, CVE-2026-111460, CVE-2026-111461)
- Highest severity: 7.7 (High · CVSSv4)
- Worst impact: Static HTTPS private key and CA private key in firmware in
- Status: No confirmed exploitation yet; patches available
- Action: Update to 4.2.2 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-111460 | 7.7 | Static HTTPS private key and CA private key in firmware in | — | Not exploited |
| CVE-2026-111459 | 7.6 | Unauthenticated server-supplied OpenVPN configuration in | 4.2.2 | Not exploited |
| CVE-2026-111461 | 7.5 | SMS upgrade argument reaches system() unescaped in | — | Not exploited |
Why It Matters
Moxa equipment connects industrial sites, utilities and remote assets. The MRC Client sets up remote VPN links to those sites. Meanwhile, the OnCell G3150A-LTE links field devices over cellular networks.
The OnCell is now end-of-life. As a result, Moxa offers no firmware fix for it, and all versions remain affected. Moxa still urges action, saying “users should apply the solutions immediately to reduce security risks.”
How the Attacks Work
CVE-2026-111459: MRC Client man-in-the-middle (CVSS 7.6)
This flaw stems from improper certificate validation. According to Moxa, an attacker “with on-path access to the communication between the MRC Client and its server could impersonate a trusted server.” That opens the door to a man-in-the-middle attack on VPN setup traffic, which could expose or alter remote access sessions. The issue title notes the client accepted an “unauthenticated server-supplied OpenVPN configuration.”
CVE-2026-111460: Shared keys in OnCell firmware (CVSS 7.7)
The OnCell firmware ships a static HTTPS private key and CA private key. An unauthenticated attacker could extract this key material. With it, they could “impersonate affected devices that have not regenerated their cryptographic keys.”
CVE-2026-111461: OnCell SMS command injection (CVSS 7.5)
This OS command injection sits in the SMS management feature. The upgrade argument “reaches system() unescaped,” per the advisory title. However, it requires high privileges, and SMS management is off by default.
Exploitation status
Moxa does not report exploitation in the wild. No public proof-of-concept has been confirmed, and none of these Moxa vulnerabilities appears in CISA’s KEV catalog. Researcher Abhinav Agarwal reported the flaws.
Affected Versions
- MRC Client: v4.2.0 and earlier
- OnCell G3150A-LTE Series: all firmware versions (end-of-life)
Patch and Mitigation Steps
- Contact Moxa Technical Support for MRC Client v4.2.2.
- Reset each OnCell gateway to regenerate its certificate and keys.
- Keep OnCell SMS management disabled unless you need it.
- Restrict device access to trusted networks with firewalls or ACLs.
- Avoid exposing OT devices directly to the internet.
- Separate operational networks from enterprise networks with VLANs or physical separation.
- Enable event logging and review logs for unauthorized access attempts.
Since the OnCell will not get a fix, owners should also plan a replacement. Until then, these Moxa vulnerabilities call for tight network controls around the OnCell G3150A-LTE.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
