Loading vulnerability…
Authenticated Root Command Injection in WNC T-Mobile 5G Box IDU
CVE-2026-58147 is an OS command injection vulnerability in the password-change functionality of the portal.cgi component of WNC T-Mobile 5G Box IDU routers. The application fails to properly neutralize shell-special elements supplied through password-change request parameters, allowing attacker-controlled input to reach operating-system command execution. A successfully authenticated attacker can execute arbitrary commands as root. Firmware releases earlier than 1.1.0.651412 are affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated attacker can obtain arbitrary root-level command execution on the router. This permits complete compromise of the device, including modification of configuration and network services, interception or alteration of routed traffic, extraction of sensitive router-resident data, establishment of persistence, and use of the device to attack connected networks.
If you can’t patch tonight, do this now.
Until firmware is upgraded, restrict the router administration interface to trusted management networks, prevent Internet exposure of management services, and limit administrative access to authorized users with strong, unique credentials. Monitor administrative activity and password-change requests for anomalous input or unexpected configuration changes.
Patch, then assume compromise.
Upgrade WNC T-Mobile 5G Box IDU routers to firmware version 1.1.0.651412 or later, which fixes the vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.