Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series (Moxa OnCell G3150A-LTE Series)
En bref
- Source
- NVD
- EPSS
- EPSS 0.30 % · centile 23 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Moxa
- Statut NVD
- Awaiting Analysis
Rechercher sur…
Description
A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.
Faiblesses (CWE)
- CWE-321 — Utilisation d'une clé cryptographique codée en dur
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | Moxa |
| CVSS 4.0 | HIGH 7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · psirt@moxa.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-110618
- GCVE · GCVE-0-2026-111460
Avis du CERT-FR
- CERTFR-2026-AVI-1393 — Multiples vulnérabilités dans les produits Moxa · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Moxa · OnCell G3150A-LTE Series | affected 1.0.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |