T-Mobile 5G Box IDU CVE-2026-40855

Requires (1) network reachability to the router's web management interface, which is adjacent/local per AV:A rather than internet-facing, and (2) valid authenticated (admin-level, PR:H) access to the device portal. The vulnerable path is the ping diagnostic feature at /cgi-bin/portal.cgi via the ping_ip, ping_size, or ping_times POST parameters - a default-present feature, so no special non-default configuration is needed once authenticated. No user interaction is required (UI:N). Exploitation is limited to firmware versions below 1.1.0.651412; the fixed firmware 1.1.0.651412 remediates it. The authentication requirement and adjacent-only vector are the primary factors limiting real-world exploitation.

This is a CWE-78 OS command injection in the ping diagnostic feature of the WNC T-Mobile 5G Box IDU router's web portal (/cgi-bin/portal.cgi), yielding root code execution. The vendor CVSS 4.0 vector (9.3) is AV:A/AC:L/AT:N/PR:H/UI:N with full VC/VI/VA:H and full subsequent-system SC/SI/SA:H - the AV:A (adjacent) and PR:H (authenticated, high-privilege) metrics are the key limiters that keep this from being a pre-auth internet-wide 10.0. Realistically this is a post-authentication privilege-escalation-to-root on the device: an attacker must already reach the router's management interface on the local/adjacent network and hold valid (admin-level) portal credentials. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not evidence of active exploitation and should be prioritized as a defensive/patch item rather than an emergency. Note a minor data conflict: the single reference URL points to CVE-2026-40854 (a neighboring CERT-PL post), not 40855 - verify the correct advisory. The high CVSS is well-earned for impact (root) but the adjacent + authenticated gating meaningfully reduces real-world attack surface versus a remote unauthenticated flaw.

An attacker on the same LAN/adjacent network as the router (or having pivoted onto it) logs into the device web portal with valid admin credentials, then submits a crafted ping request to /cgi-bin/portal.cgi with shell metacharacters in the ping_ip, ping_size, or ping_times POST parameter. The unsanitized input is passed to a system shell, executing arbitrary commands as root and giving full control of the router. No public proof-of-concept exploit is identified in the provided data.