Read the docs
TI-2026-41864 Aliases CVE-2026-58146GHSA-57h3-7px2-2q83

Unauthorized remote code execution in T-Mobile 5G Box IDU routers

Priority MEDIUM 48CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root on the underlying operating system. This issue has been fixed in firmware version 1.1.0.651412

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02889 86th percentileScored 2026-11-07
Fix Fixed T-Mobile 5G Box IDU (WNC): 1.1.0.651412

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WNCT-Mobile 5G Box IDUbefore 1.1.0.6514121.1.0.651412Patch availableCNA
  • T-Mobile 5G Box IDU VendorWNC Affected before 1.1.0.651412 Fixed in 1.1.0.651412 Patch available CNA

Remediation

  • Fix · CNA T-Mobile 5G Box IDU (WNC) Fixed in 1.1.0.651412

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WNC T-Mobile 5G Box IDU 1.1.0.651412

    6 records Highest priority Priority MEDIUM 4 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-41865 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routersPriority MEDIUM 45
    • TI-2026-29512 Command Injection in T-Mobile 5G Box IDU router via ping functionalityPriority MEDIUM 45
    • TI-2026-29511 Session auth bypass via cookie value in T-Mobile 5G Box IDU routersPriority MEDIUM 40
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58146
  2. 2026-10-03 Alias added: GHSA-57h3-7px2-2q83

References

Advisory 1

  • TI-2026-41865 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers CVSS 4.0CRITICAL 9.3
  • TI-2026-29512 Command Injection in T-Mobile 5G Box IDU router via ping functionality CVSS 4.0CRITICAL 9.3
  • TI-2026-29511 Session auth bypass via cookie value in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 8.7
  • TI-2026-29514 CSRF token bypass in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 8.4
  • TI-2026-29513 Config disclosure in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences