EUVD-2026-80674
GHSA-pfx4-383w-6gx3
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent management-network access (AV:A) and required admin login (PR:H) gate exploitation; root command injection on the device itself yields full C/I/A with no cross-system scope change (S:U).
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
3DescriptionCVE.org
WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version 1.1.0.651412
AnalysisAI
OS command injection in the WNC T-Mobile 5G Box IDU router's portal.cgi password-change function allows an attacker who already holds high-privilege portal credentials and is positioned on the adjacent network to run arbitrary operating-system commands as root, yielding full device compromise (CVSS 4.0 base 9.3). The root cause is improper neutralization of shell metacharacters in the http_passwd_hidden and http_passwdConfirm_hidden parameters, so a crafted password-change request is interpreted by the underlying shell rather than treated as inert input. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) network reachability to the device's management portal (CVSS AV:A indicates adjacent/local-network access, i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 9.3 (AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) is driven by full compromise impact (root code execution) but is tempered by two real limiters that keep this below a drive-by internet worm scenario: AV:A means the attacker must be on the adjacent/local network (the router's LAN/management side, not the public internet), and PR:H means valid high-privilege portal credentials are required first. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the T-Mobile 5G Box IDU to firmware version 1.1.0.651412 (or later), which resolves the portal.cgi parameter-handling flaw; consult the CERT-PL advisory at https://cert.pl/posts/2026/09/CVE-2026-40854 and the device vendor for the firmware image and update procedure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WNC T-Mobile 5G Box IDU router in the estate and flag any unit running firmware below 1.1.0.651412; confirm that administrator portal access is restricted to trusted staff, rotate administrative credentials on any exposed units, and verify the management interface is not reachable from untrusted network segments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in T Mobile 5G Box Idu
View allUnauthenticated OS command injection in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) lets an attacke
Authenticated OS command injection in the WNC T-Mobile 5G Box IDU router's web management portal lets an admin-level att
Authentication bypass in the WNC T-Mobile 5G Box IDU router lets an attacker on the adjacent network reach the portal.cg
Cross-site request forgery in the WNC T-Mobile 5G Box IDU router (portal.cgi) lets a remote attacker drive privileged ac
WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without an
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today