T Mobile 5G Box Idu
Monthly
OS command injection in the WNC T-Mobile 5G Box IDU router's portal.cgi password-change function allows an attacker who already holds high-privilege portal credentials and is positioned on the adjacent network to run arbitrary operating-system commands as root, yielding full device compromise (CVSS 4.0 base 9.3). The root cause is improper neutralization of shell metacharacters in the http_passwd_hidden and http_passwdConfirm_hidden parameters, so a crafted password-change request is interpreted by the underlying shell rather than treated as inert input. Only firmware below 1.1.0.651412 is affected and the issue is fixed in 1.1.0.651412; exploitation is constrained by AV:A (LAN/Wi-Fi-side reachability, not the public internet) and PR:H (valid admin credentials required first), and no public exploit identified at time of analysis.
Unauthenticated OS command injection in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) lets an attacker on the adjacent network run arbitrary shell commands as root through a crafted cli_cookie parameter POSTed to /cgi-bin/portal.cgi. Because the affected parameter is concatenated straight into a shell 'find' command with no sanitization, successful exploitation yields full root-level control of the device - high confidentiality, integrity, and availability impact - and the CVSS 4.0 score of 9.4 reflects that severity. The decisive limiting factor is reachability: the vector is AV:A (adjacent), so the attacker must already sit on the LAN/Wi-Fi side or the same L2 segment unless the management interface is exposed to the WAN. There is no CISA KEV entry and no public exploit code identified at time of analysis, but a vendor patch exists, and CERT-PL is credited with reporting the issue.
Cross-site request forgery in the WNC T-Mobile 5G Box IDU router (portal.cgi) lets a remote attacker drive privileged actions through an already-authenticated administrator's browser, because the anti-CSRF check accepts any value supplied in the csrf_token_value parameter. The flaw affects firmware versions below 1.1.0.651412, is rated 8.4 under CVSS 4.0 (AV:A/PR:N/UI:A, high confidentiality and integrity impact, low availability impact), and requires the victim to be logged into the router portal while being lured to an attacker-controlled page reachable over the adjacent network. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a fixed firmware build, so risk is real but conditional rather than an emergency patch-now scenario.
WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without any authentication, letting a device on the same network segment read sensitive configuration data - including the administrator web password and the WiFi passphrase. Exploitation requires network adjacency (CVSS AV:A) such as a rogue or legitimate WiFi client or a wired LAN host; it is not reachable over the internet by default, but no credentials or user interaction are needed once that position is obtained. The result is a direct path to full administrative takeover of the router, which is why the assessed confidentiality impact is high despite the bounded attack surface. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available.
Authenticated OS command injection in the WNC T-Mobile 5G Box IDU router's web management portal lets an admin-level attacker on the adjacent network run arbitrary shell commands as root. The flaw (CWE-78) sits in the ping diagnostic feature of /cgi-bin/portal.cgi, where the ping_ip, ping_size, and ping_times POST parameters are concatenated into a system command without validation or sanitization; no user interaction is required once credentials are held. All firmware versions below 1.1.0.651412 are affected, and exploitation is constrained by two prerequisites - network reachability to the portal (AV:A, adjacent/local rather than internet-facing) and valid high-privilege (PR:H) portal access - so the practical risk, despite the 9.3 CVSS 4.0 base score, is bounded by the fact that the attacker must already be an authenticated admin on the local network segment. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; CVE-2026-40855 was reported by CERT-PL and a vendor patch exists.
Authentication bypass in the WNC T-Mobile 5G Box IDU router lets an attacker on the adjacent network reach the portal.cgi administration interface and log in without credentials by setting the sessionid cookie to a directory entry such as '.' or '..' that always exists under /tmp/login_user. The flaw affects firmware versions before 1.1.0.651412 and requires no authentication, no user interaction, and no non-default configuration - only network adjacency to the device (LAN or Wi-Fi side), since the assessed vector is AV:A. Impact is total: full read/write/execute control of the administrative panel, which is why the score is high (CVSS 4.0 8.7; assessed CVSS 3.1 8.7, C:H/I:H/A:H); no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor firmware 1.1.0.651412 resolves the issue.
OS command injection in the WNC T-Mobile 5G Box IDU router's portal.cgi password-change function allows an attacker who already holds high-privilege portal credentials and is positioned on the adjacent network to run arbitrary operating-system commands as root, yielding full device compromise (CVSS 4.0 base 9.3). The root cause is improper neutralization of shell metacharacters in the http_passwd_hidden and http_passwdConfirm_hidden parameters, so a crafted password-change request is interpreted by the underlying shell rather than treated as inert input. Only firmware below 1.1.0.651412 is affected and the issue is fixed in 1.1.0.651412; exploitation is constrained by AV:A (LAN/Wi-Fi-side reachability, not the public internet) and PR:H (valid admin credentials required first), and no public exploit identified at time of analysis.
Unauthenticated OS command injection in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) lets an attacker on the adjacent network run arbitrary shell commands as root through a crafted cli_cookie parameter POSTed to /cgi-bin/portal.cgi. Because the affected parameter is concatenated straight into a shell 'find' command with no sanitization, successful exploitation yields full root-level control of the device - high confidentiality, integrity, and availability impact - and the CVSS 4.0 score of 9.4 reflects that severity. The decisive limiting factor is reachability: the vector is AV:A (adjacent), so the attacker must already sit on the LAN/Wi-Fi side or the same L2 segment unless the management interface is exposed to the WAN. There is no CISA KEV entry and no public exploit code identified at time of analysis, but a vendor patch exists, and CERT-PL is credited with reporting the issue.
Cross-site request forgery in the WNC T-Mobile 5G Box IDU router (portal.cgi) lets a remote attacker drive privileged actions through an already-authenticated administrator's browser, because the anti-CSRF check accepts any value supplied in the csrf_token_value parameter. The flaw affects firmware versions below 1.1.0.651412, is rated 8.4 under CVSS 4.0 (AV:A/PR:N/UI:A, high confidentiality and integrity impact, low availability impact), and requires the victim to be logged into the router portal while being lured to an attacker-controlled page reachable over the adjacent network. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a fixed firmware build, so risk is real but conditional rather than an emergency patch-now scenario.
WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without any authentication, letting a device on the same network segment read sensitive configuration data - including the administrator web password and the WiFi passphrase. Exploitation requires network adjacency (CVSS AV:A) such as a rogue or legitimate WiFi client or a wired LAN host; it is not reachable over the internet by default, but no credentials or user interaction are needed once that position is obtained. The result is a direct path to full administrative takeover of the router, which is why the assessed confidentiality impact is high despite the bounded attack surface. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available.
Authenticated OS command injection in the WNC T-Mobile 5G Box IDU router's web management portal lets an admin-level attacker on the adjacent network run arbitrary shell commands as root. The flaw (CWE-78) sits in the ping diagnostic feature of /cgi-bin/portal.cgi, where the ping_ip, ping_size, and ping_times POST parameters are concatenated into a system command without validation or sanitization; no user interaction is required once credentials are held. All firmware versions below 1.1.0.651412 are affected, and exploitation is constrained by two prerequisites - network reachability to the portal (AV:A, adjacent/local rather than internet-facing) and valid high-privilege (PR:H) portal access - so the practical risk, despite the 9.3 CVSS 4.0 base score, is bounded by the fact that the attacker must already be an authenticated admin on the local network segment. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; CVE-2026-40855 was reported by CERT-PL and a vendor patch exists.
Authentication bypass in the WNC T-Mobile 5G Box IDU router lets an attacker on the adjacent network reach the portal.cgi administration interface and log in without credentials by setting the sessionid cookie to a directory entry such as '.' or '..' that always exists under /tmp/login_user. The flaw affects firmware versions before 1.1.0.651412 and requires no authentication, no user interaction, and no non-default configuration - only network adjacency to the device (LAN or Wi-Fi side), since the assessed vector is AV:A. Impact is total: full read/write/execute control of the administrative panel, which is why the score is high (CVSS 4.0 8.7; assessed CVSS 3.1 8.7, C:H/I:H/A:H); no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor firmware 1.1.0.651412 resolves the issue.