Loading vulnerability…
Unauthenticated Root OS Command Injection in WNC T-Mobile 5G Box IDU
CVE-2026-58146 is an OS command injection vulnerability in the WNC T-Mobile 5G Box IDU router web-management interface. A POST-supplied cookie-related value is concatenated into a shell find command without sanitization, allowing shell metacharacters or command substitutions to alter the command executed by the router.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can execute arbitrary shell commands with root privileges on the router operating system. This provides complete compromise of router confidentiality, integrity, and availability, including the ability to access or alter configuration and traffic-related functionality, establish persistence, and disrupt service. The reported CVSS v4.0 base score is 9.4 (Critical).
If you can’t patch tonight, do this now.
No vendor workaround is specified. Until firmware is upgraded, restrict access to the router web-management interface to trusted management networks and prevent untrusted remote access to the affected CGI service.
Patch, then assume compromise.
Upgrade affected WNC T-Mobile 5G Box IDU routers to firmware version 1.1.0.651412 or later. Firmware versions earlier than 1.1.0.651412 are affected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.