CVE-2026-111460: Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series
A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.
Affected Software
Event History
Frequently Asked Questions
Which devices are exposed to impersonation risk?
Affected OnCell G3150A-LTE Series devices that have not regenerated their cryptographic keys are exposed. Devices using regenerated keys are not identified by the available information as sharing the affected key material.
What must an attacker be able to do to exploit this issue?
The attacker is unauthenticated and remote, but must be able to obtain the shared cryptographic key material under the conditions described. The available information does not specify those conditions or the method used to obtain the keys.
What is the practical impact if exploitation succeeds?
An attacker could impersonate an affected device and potentially compromise the confidentiality and integrity of management communications.
What can be done when patching is not immediately possible?
Regenerate cryptographic keys on affected devices, since the stated exposure applies to devices that have not regenerated their keys. The provided information does not describe additional mitigations.