Six Flaws in T-Mobile 5G Box IDU Routers Enable Root Command Execution
Vulnerability Disclosure · 4 sources · Updated 1mo ago · First seen Sep 16, 2026
CERT Polska disclosed six vulnerabilities in WNC (Wistron NeWeb Corporation) T-Mobile 5G Box IDU router firmware versions earlier than 1.1.0.651412: CVE-2026-58146, CVE-2026-58147, and CVE-2026-40854 through CVE-2026-40857. The issues include an authentication bypass, three OS command-injection flaws, unauthenticated information disclosure, and CSRF; affected devices may expose sensitive configuration data, including administrator credentials and Wi-Fi passphrases, or permit remote shell-command execution as root.
CVE-2026-40854 abuses session validation in portal.cgi, where crafted sessionid cookie values such as directory references can bypass access controls and reach the administration panel (CVSS 8.7). CVE-2026-40855 affects the portal.cgi ping function: insufficient validation of ping_ip, ping_size, and ping_times permits an authenticated attacker to inject shell commands as root (CVSS 9.3). WNC has addressed all six flaws in firmware 1.1.0.651412; organizations operating these routers should identify devices and upgrade promptly.
