Which versions of T-Mobile 5G Box IDU are affected by CVE-2026-58147?

A critical command-injection flaw in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) allows someone who already holds administrator credentials on the local network to execute…. A patch is available.

How to fix or mitigate CVE-2026-58147?

Within 24 hours, inventory every WNC T-Mobile 5G Box IDU router in the estate and flag any unit running firmware below 1.1.0.651412; confirm that administrator portal access is restricted to trusted staff, rotate administrative credentials on any exposed units, and verify the management interface is not reachable from untrusted network segments. Within 7 days, upgrade all affected devices to vendor-released patch 1.1.0.651412 (or later), prioritizing units in branch, retail, and remote-worker locations where the adjacent network is shared or physically accessible. Within 30 days, validate remediation through a re-scan attesting that no unit reports a firmware version below 1.1.0.651412, fold the minimum-firmware baseline into procurement and device-onboarding checks, and add these routers to routine firmware-compliance reporting. Note that exploitation requires valid high-privilege portal credentials and adjacent-network positioning, and that no public exploit code has been identified at time of analysis, so no emergency outage or device isolation is warranted while patching proceeds.

T-Mobile 5G Box IDU CVE-2026-58147

Q: What is the CVSS score of CVE-2026-58147?

CVE-2026-58147 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80674 CRITICAL

OS Command Injection (CWE-78)

2026-09-16 CERT-PL

GHSA-pfx4-383w-6gx3

Command Injection T Mobile 5G Box Idu

9.3

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Adjacent management-network access (AV:A) and required admin login (PR:H) gate exploitation; root command injection on the device itself yields full C/I/A with no cross-system scope change (S:U).

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 12:17 vuln.today

Patch available

Sep 16, 2026 - 12:03 EUVD

CVE Published

Sep 16, 2026 - 11:21 cve.org

CRITICAL 9.3

DescriptionCVE.org

WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version 1.1.0.651412

AnalysisAI

OS command injection in the WNC T-Mobile 5G Box IDU router's portal.cgi password-change function allows an attacker who already holds high-privilege portal credentials and is positioned on the adjacent network to run arbitrary operating-system commands as root, yielding full device compromise (CVSS 4.0 base 9.3). The root cause is improper neutralization of shell metacharacters in the http_passwd_hidden and http_passwdConfirm_hidden parameters, so a crafted password-change request is interpreted by the underlying shell rather than treated as inert input. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) network reachability to the device's management portal (CVSS AV:A indicates adjacent/local-network access, i.e. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 9.3 (AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) is driven by full compromise impact (root code execution) but is tempered by two real limiters that keep this below a drive-by internet worm scenario: AV:A means the attacker must be on the adjacent/local network (the router's LAN/management side, not the public internet), and PR:H means valid high-privilege portal credentials are required first. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade the T-Mobile 5G Box IDU to firmware version 1.1.0.651412 (or later), which resolves the portal.cgi parameter-handling flaw; consult the CERT-PL advisory at https://cert.pl/posts/2026/09/CVE-2026-40854 and the device vendor for the firmware image and update procedure. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every WNC T-Mobile 5G Box IDU router in the estate and flag any unit running firmware below 1.1.0.651412; confirm that administrator portal access is restricted to trusted staff, rotate administrative credentials on any exposed units, and verify the management interface is not reachable from untrusted network segments. …

Threat intelligence, references, and detailed analysis are available after sign-in.