Moxa discloses three flaws in remote access products

Moxa has disclosed three high-severity vulnerabilities affecting its Remote Connect Suite (MRC Client) and the end‑of‑life OnCell G3150A-LTE gateway. The flaws are CVE-2026-111459 (Unauthenticated server-supplied OpenVPN configuration in MRC Client), CVE-2026-111460 (static HTTPS private key and CA private key in OnCell firmware), and CVE-2026-111461 (SMS upgrade command injection).

Moxa’s advisory, MPSA-269510, notes that MRC Client users can apply a patch to version 4.2.2, while the OnCell G3150A-LTE gateway—being end of life—will not receive a firmware fix; mitigations are required instead.

Affected versions include MRC Client v4.2.0 and earlier, and all OnCell G3150A-LTE firmware versions. In terms of impact, CVE-2026-111459 could enable a man‑in‑the‑middle on VPN setup traffic due to improper certificate validation; CVE-2026-111460 involves the exposure of static certificate keys that could allow impersonation of devices; CVE-2026-111461 describes an OS command injection via SMS management, though it requires high privileges and is off by default.

There is no reported exploitation in the wild at this time, and none of the CVEs appear in the CISA KEV catalog; Abhinav Agarwal is named as a researcher.

Mitigation steps include upgrading MRC Client to v4.2.2, regenerating certificates on OnCell gateways, keeping SMS management disabled unless needed, and tightening network controls (firewalls/ACLs, VLANs, network segmentation) since the OnCell hardware will not be fixed and replacement planning is advised.