CVE-2026-40855
CriticalCVSS 9.3Summary
The WNC T-Mobile 5G Box IDU router is vulnerable to command injection in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root cause is the failure to verify and sanitize user-supplied input before incorporating it into a system command, allowing an authenticated attacker to execute arbitrary shell commands and gain root access. The issue is fixed in firmware version 1.1.0.651412.
Risk Assessment
An authenticated attacker can gain full control of the router with root privileges. This may lead to traffic interception, configuration changes, or using the device for further attacks.
Recommendation
Update the WNC T-Mobile 5G Box IDU router firmware to version 1.1.0.651412 or later. Change default administrative passwords and restrict access to the management interface.
Other vulnerabilities in WNC T-Mobile 5G Box IDU router
See all- CVE-2026-40856High
The WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The wnc_maccheck.cgi endpoint is accessible without authentication, allowing a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi passphrase, and technical device information. This issue has been fixed in firmware version 1.1.0.651412.
- CVE-2026-40854High
The WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by only checking for the existence of a corresponding file in /tmp/login_user. An attacker can bypass authentication by using directory entries such as "." or ".." in the cookie, allowing unauthorized access to the administration panel. This issue has been fixed in firmware version 1.1.0.651412.
- CVE-2026-58147Critical
The WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges. The issue is fixed in firmware version 1.1.0.651412.
- CVE-2026-58146Critical
The WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection in the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie value is directly concatenated into a find command string without proper sanitization, allowing a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root. The issue is fixed in firmware version 1.1.0.651412.
Original NVD description (English source)
WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root cause is the failure to verify and sanitize user-supplied input before incorporating it into a system command. This allows an authenticated attacker to execute arbitrary commands on the shell and gain root access to the system.This issue has been fixed in firmware version 1.1.0.651412