T-Mobile 5G Box IDU CVE-2026-58146

Exploitation requires network reachability to the device's /cgi-bin/portal.cgi endpoint and the ability to send an HTTP POST with a crafted cli_cookie parameter; no authentication and no user interaction are needed (PR:N/UI:N), and default firmware below 1.1.0.651412 is vulnerable. The key limiting factor is the CVSS AV:A (adjacent) rating: the attacker must be on the local or adjacent network of the T-Mobile 5G Box IDU (LAN/Wi‑Fi side or same L2 segment) rather than arbitrarily across the internet, UNLESS the management interface is exposed on the WAN. Installing firmware 1.1.0.651412 remediates the issue.

This is a genuinely high-priority flaw where the signals are mostly consistent. The CVSS 4.0 base score of 9.4 reflects an unauthenticated (PR:N), low-complexity (AC:L) OS command injection (CWE-78) yielding root - full compromise of confidentiality, integrity and availability. The one important nuance is the attack vector: the vendor/CERT-PL vector specifies AV:A (adjacent), NOT AV:N (network), even though the prose description says 'remote, unauthenticated attacker.' This is a real conflict worth resolving: AV:A implies the attacker must reach the device from its local/adjacent network (e.g., the LAN or Wi‑Fi side of the CPE, or the same L2 segment) rather than arbitrarily across the internet - unless the /cgi-bin/portal.cgi management interface is exposed on the WAN side. Defenders should verify WAN-side exposure with the vendor, because that single fact swings realistic risk substantially. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active exploitation or automated weaponization at this time; the danger here is intrinsic (trivial, reliable root RCE) rather than proven in-the-wild activity. Net: treat as a patch-now issue for exposed/adjacent-reachable devices, but note the AV:A limiter tempers the 'internet-wide worm' framing the description language might suggest.

An attacker on the same network segment as the T-Mobile 5G Box IDU (e.g., connected to its LAN/Wi‑Fi, or on an adjacent segment, or reaching an exposed management port) sends a crafted POST request to /cgi-bin/portal.cgi with a malicious cli_cookie value containing shell metacharacters. Because cli_cookie is concatenated directly into a find command without sanitization, the injected commands execute as root, giving full device takeover. No public exploit code was identified at time of analysis, but the injection is trivial to reproduce from the description.