Which versions of T-Mobile 5G Box IDU are affected by CVE-2026-58146?

The WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) is affected by a critical command injection vulnerability that allows an attacker on the adjacent network to gain full root control of…. A patch is available.

How to fix or mitigate CVE-2026-58146?

Within 24 hours, identify all WNC T-Mobile 5G Box IDU routers with firmware versions below 1.1.0.651412 and apply the vendor patch to version 1.1.0.651412 or later; if patching is not immediately feasible, isolate these devices on a separate network segment and restrict management interface access. Within 7 days, verify patch deployment across all affected devices and conduct a network scan to ensure no unpatched instances remain. Within 30 days, review network segmentation policies to limit adjacent network access to critical devices and conduct a security assessment to detect any signs of compromise.

T-Mobile 5G Box IDU CVE-2026-58146

Q: What is the CVSS score of CVE-2026-58146?

CVE-2026-58146 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80673 CRITICAL

OS Command Injection (CWE-78)

2026-09-16 CERT-PL

GHSA-57h3-7px2-2q83

Command Injection T Mobile 5G Box Idu

9.4

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Unauthenticated adjacent-network command injection giving root, so PR:N/UI:N/AV:A/AC:L with full C/I/A on the device; scope unchanged as the OS is the vulnerable system.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 12:17 vuln.today

Patch available

Sep 16, 2026 - 12:03 EUVD

CVE Published

Sep 16, 2026 - 11:21 cve.org

CRITICAL 9.4

DescriptionCVE.org

WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root on the underlying operating system.

This issue has been fixed in firmware version 1.1.0.651412

AnalysisAI

Unauthenticated OS command injection in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) lets an attacker on the adjacent network run arbitrary shell commands as root through a crafted cli_cookie parameter POSTed to /cgi-bin/portal.cgi. Because the affected parameter is concatenated straight into a shell 'find' command with no sanitization, successful exploitation yields full root-level control of the device - high confidentiality, integrity, and availability impact - and the CVSS 4.0 score of 9.4 reflects that severity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the device's /cgi-bin/portal.cgi endpoint and the ability to send an HTTP POST with a crafted cli_cookie parameter; no authentication and no user interaction are needed (PR:N/UI:N), and default firmware below 1.1.0.651412 is vulnerable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuinely high-priority flaw where the signals are mostly consistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary fix is to upgrade the T-Mobile 5G Box IDU to firmware 1.1.0.651412 or later, which the vendor confirms resolves the command injection; because this is carrier-managed CPE, updates are typically delivered via T-Mobile/WNC OTA or the device's management interface, and owners should verify the running version after the update rather than assume it applied. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all WNC T-Mobile 5G Box IDU routers with firmware versions below 1.1.0.651412 and apply the vendor patch to version 1.1.0.651412 or later; if patching is not immediately feasible, isolate these devices on a separate network segment and restrict management interface access. …

Threat intelligence, references, and detailed analysis are available after sign-in.