Read the docs
TI-2026-29512 Aliases CVE-2026-40855GHSA-5qwp-rxmm-2vwh

Command Injection in T-Mobile 5G Box IDU router via ping functionality

Priority MEDIUM 45CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root cause is the failure to verify and sanitize user-supplied input before incorporating it into a system command. This allows an authenticated attacker to execute arbitrary commands on the shell and gain root access to the system.This issue has been fixed in firmware version 1.1.0.651412

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01592 75th percentileScored 2026-11-07
Fix Fixed T-Mobile 5G Box IDU (WNC): 1.1.0.651412

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WNCT-Mobile 5G Box IDUbefore 1.1.0.6514121.1.0.651412Patch availableCNA
  • T-Mobile 5G Box IDU VendorWNC Affected before 1.1.0.651412 Fixed in 1.1.0.651412 Patch available CNA

Remediation

  • Fix · CNA T-Mobile 5G Box IDU (WNC) Fixed in 1.1.0.651412

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WNC T-Mobile 5G Box IDU 1.1.0.651412

    6 records Highest priority Priority MEDIUM 4 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-41864 Unauthorized remote code execution in T-Mobile 5G Box IDU routersPriority MEDIUM 48
    • TI-2026-41865 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routersPriority MEDIUM 45
    • TI-2026-29511 Session auth bypass via cookie value in T-Mobile 5G Box IDU routersPriority MEDIUM 40
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40855
  2. 2026-10-03 Alias added: GHSA-5qwp-rxmm-2vwh

References

Advisory 1

  • TI-2026-41864 Unauthorized remote code execution in T-Mobile 5G Box IDU routers CVSS 4.0CRITICAL 9.4
  • TI-2026-41865 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers CVSS 4.0CRITICAL 9.3
  • TI-2026-29511 Session auth bypass via cookie value in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 8.7
  • TI-2026-29514 CSRF token bypass in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 8.4
  • TI-2026-29513 Config disclosure in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences