OS Command Injection Vulnerability in WNC T-Mobile 5G Box Router
CVE-2026-58146

9.4CRITICAL

Key Information:

Vendor

Wnc

Status
T-mobile 5g Box Idu
Vendor
CVE Published:
16 September 2026

What is CVE-2026-58146?

The WNC T-Mobile 5G Box IDU router contains a significant OS command injection vulnerability that arises from improper handling of input at the /cgi-bin/portal.cgi endpoint. Specifically, the cli_cookie POST parameter is exploited as it is concatenated into a system command without adequate sanitization. This oversight enables a remote, unauthenticated attacker to inject arbitrary shell commands, potentially allowing them to execute these commands with root privileges on the device's operating system. To mitigate this vulnerability, users are advised to update to firmware version 1.1.0.651412 or later.

Affected Version(s)

T-Mobile 5G Box IDU 0 < 1.1.0.651412

References

https://cert.pl/posts/2026/09/CVE-2026-40854
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Patryk Bogdan
Adam Borczyk
.