Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-58146

Unauthorized remote code execution in T-Mobile 5G Box IDU routers

CVSS 4.0 9.4 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-58146

Published

WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root on the underlying operating system. This issue has been fixed in firmware version 1.1.0.651412

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-58146

Published

T-Mobile 5G Box IDU

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "WNC",
                    "product": "T-Mobile 5G Box IDU",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "1.1.0.651412",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON