Read the docs
TI-2026-41865 Aliases CVE-2026-58147GHSA-pfx4-383w-6gx3

Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers

Priority MEDIUM 45CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version 1.1.0.651412

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01579 75th percentileScored 2026-11-07
Fix Fixed T-Mobile 5G Box IDU (WNC): 1.1.0.651412

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WNCT-Mobile 5G Box IDUbefore 1.1.0.6514121.1.0.651412Patch availableCNA
  • T-Mobile 5G Box IDU VendorWNC Affected before 1.1.0.651412 Fixed in 1.1.0.651412 Patch available CNA

Remediation

  • Fix · CNA T-Mobile 5G Box IDU (WNC) Fixed in 1.1.0.651412

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WNC T-Mobile 5G Box IDU 1.1.0.651412

    6 records Highest priority Priority MEDIUM 4 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-41864 Unauthorized remote code execution in T-Mobile 5G Box IDU routersPriority MEDIUM 48
    • TI-2026-29512 Command Injection in T-Mobile 5G Box IDU router via ping functionalityPriority MEDIUM 45
    • TI-2026-29511 Session auth bypass via cookie value in T-Mobile 5G Box IDU routersPriority MEDIUM 40
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58147
  2. 2026-10-03 Alias added: GHSA-pfx4-383w-6gx3

References

Advisory 1

  • TI-2026-41864 Unauthorized remote code execution in T-Mobile 5G Box IDU routers CVSS 4.0CRITICAL 9.4
  • TI-2026-29512 Command Injection in T-Mobile 5G Box IDU router via ping functionality CVSS 4.0CRITICAL 9.3
  • TI-2026-29511 Session auth bypass via cookie value in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 8.7
  • TI-2026-29514 CSRF token bypass in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 8.4
  • TI-2026-29513 Config disclosure in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences