T-Mobile 5G Box IDU EUVD-2026-80674

Exploitation requires: (1) network reachability to the device's management portal (CVSS AV:A indicates adjacent/local-network access, i.e. the LAN or Wi-Fi side, not the public internet), and (2) valid high-privilege portal credentials (PR:H) to reach the authenticated password-change function. The specific trigger is supplying shell metacharacters in the http_passwd_hidden and/or http_passwdConfirm_hidden parameters of portal.cgi during a password change. Limiting factors: the pre-requisite of admin authentication and adjacent-network positioning meaningfully constrain who can exploit this; devices are only vulnerable on firmware below 1.1.0.651412 (fixed in 1.1.0.651412). No user interaction is required (UI:N).

The CVSS 4.0 base score of 9.3 (AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) is driven by full compromise impact (root code execution) but is tempered by two real limiters that keep this below a drive-by internet worm scenario: AV:A means the attacker must be on the adjacent/local network (the router's LAN/management side, not the public internet), and PR:H means valid high-privilege portal credentials are required first. This is consistent with the description, which explicitly says 'authenticated attacker' via the portal.cgi password-change function. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided intelligence, so exploitation status is: no public exploit identified at time of analysis. Net assessment: this is a genuine root-level command injection worth patching, but the combined AV:A + PR:H gating means realistic risk is post-authentication lateral escalation / device persistence rather than mass unauthenticated exploitation. It is not a high-CVSS-but-trivial issue (the root impact is real), yet it is also not an immediate internet-facing emergency in the absence of KEV/EPSS/POC signals. One data caveat: the single reference URL (cert.pl .../CVE-2026-40854) cites a DIFFERENT CVE identifier than the one under analysis (CVE-2026-58147) - this mismatch should be verified with CERT-PL before treating the advisory as authoritative for this exact CVE.

An attacker who has already obtained administrative/portal credentials for a WNC T-Mobile 5G Box IDU router (e.g., default or reused admin password reachable from the LAN or adjacent Wi-Fi) submits a crafted password-change request to portal.cgi, embedding shell metacharacters in the http_passwd_hidden or http_passwdConfirm_hidden parameters. Because these values are not properly neutralized, the injected commands execute on the underlying OS as root, giving full device takeover. No public proof-of-concept exploit is identified in the provided data.