GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
CVE-2026-111461high7.5

SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series

Impact

An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.

Source excerpt · Moxa

What to do

Please refer to the following mitigation measures to reduce the risk of exploitation:

For CVE-2026-111461, keep the SMS functionality disabled unless it is required for operation. This functionality is disabled by default. If it is not needed, Moxa recommends leaving it disabled to reduce the risk of exploitation.

Moxa guidance

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Moxa · OnCell G3150A-LTE Series

Other versions: affected

Version / rangeSource status
1.0.0affected
Moxa version evidence

Original source description

An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device.

References