Vulnerabilities

TI-2026-41865 CVE-2026-58147 · GHSA-pfx4-383w-6gx3

Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers

MEDIUM 45

WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality.

CVSS 4.0CRITICAL 9.3 Adjacent network High privileges No interaction EPSS 0.01579 Published 2026-09-16 Fixed in 1.1.0.651412 CWE-78

TI-2026-41864 CVE-2026-58146 · GHSA-57h3-7px2-2q83

MEDIUM 48

WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability.

CVSS 4.0CRITICAL 9.4 Adjacent network No auth No interaction EPSS 0.02889 Published 2026-09-16 Fixed in 1.1.0.651412 CWE-78

TI-2026-29514 CVE-2026-40857 · GHSA-6v9q-56wf-hqwp

LOW 38

WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component.

CVSS 4.0HIGH 8.4 Adjacent network No auth User interaction EPSS 0.00197 Published 2026-09-16 Fixed in 1.1.0.651412 CWE-352

TI-2026-29513 CVE-2026-40856 · GHSA-xw9f-4565-4fvc

LOW 31

WNC T-Mobile 5G Box IDU router is vulnerable to improper access control.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00373 Published 2026-09-16 Fixed in 1.1.0.651412 CWE-306

TI-2026-29512 CVE-2026-40855 · GHSA-5qwp-rxmm-2vwh

MEDIUM 45

WNC T-Mobile 5G Box IDU router is vulnerable to a command injection.

CVSS 4.0CRITICAL 9.3 Adjacent network High privileges No interaction EPSS 0.01592 Published 2026-09-16 Fixed in 1.1.0.651412 CWE-78

TI-2026-29511 CVE-2026-40854 · GHSA-7wq2-g42r-wr2h

MEDIUM 40

WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component.

CVSS 4.0HIGH 8.7 Adjacent network No auth No interaction EPSS 0.00319 Published 2026-09-16 Fixed in 1.1.0.651412 CWE-290