Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The firmware of the Moxa OnCell G3150A-LTE Series industrial cellular gateways contains a static HTTPS private key and CA private key that are shared across devices. An unauthenticated remote attacker could use these keys to impersonate affected devices that have not regenerated their keys, potentially compromising the confidentiality and integrity of management communications.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Moxa OnCell G3150A-LTE Series
1.0.0