CVE-2026-40855 in T-Mobile 5G Box IDU
Summary
by MITRE • 09/16/2026
WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root cause is the failure to verify and sanitize user-supplied input before incorporating it into a system command. This allows an authenticated attacker to execute arbitrary commands on the shell and gain root access to the system.This issue has been fixed in firmware version 1.1.0.651412
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The WNC T-Mobile 5G Box IDU router contains a critical command injection vulnerability within its web management interface, specifically located in the ping functionality exposed through the /cgi-bin/portal.cgi endpoint. This flaw affects three distinct POST parameters: ping_ip, ping_size, and ping_times. The root cause of this security issue is the failure to properly validate or sanitize user-supplied input before it is incorporated into a system command string executed by the underlying operating system shell. Because these parameters are directly concatenated into shell commands without adequate filtering for special characters such as semicolons, ampersands, or pipe operators, an attacker can inject arbitrary Linux commands that will be interpreted and executed with the privileges of the web server process.
This vulnerability is classified under CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The severity of this flaw is significantly amplified by the fact that it allows for remote code execution with root-level privileges after authentication. While many router vulnerabilities require unauthenticated access to be critical, this specific issue requires a valid user account on the device. However, given that default credentials are often widely documented or easily guessed in consumer-grade networking equipment, the practical risk remains extremely high. An authenticated attacker can exploit these parameters to execute arbitrary system commands, effectively gaining full control over the router's operating environment.
The operational impact of this vulnerability extends beyond simple command execution. By achieving root access, an adversary can compromise the integrity and confidentiality of all network traffic passing through the device. This includes the ability to intercept sensitive data such as login credentials, financial information, or proprietary communications traversing the 5G connection. Furthermore, a compromised router serves as a persistent foothold within the local network, allowing attackers to pivot to other connected devices, perform man-in-the-middle attacks, or establish reverse shells for long-term access. The attacker can also modify firewall rules, disable security logging, and install malicious firmware updates that persist across reboots, creating a resilient backdoor into the victim's infrastructure.
Mitigation strategies must prioritize immediate patching if available. As noted in the vendor advisory, this issue has been resolved in firmware version 1.1.0.651412. Administrators should verify their current firmware version and update to this patched release as soon as possible. In environments where updating is not immediately feasible due to operational constraints or lack of patch availability, network segmentation can provide a layer of defense by isolating the router from critical internal assets. Additionally, enforcing strong, unique passwords for all administrative accounts reduces the likelihood of an attacker obtaining the necessary authentication credentials required to exploit this vulnerability. Monitoring logs for unusual outbound connections or unexpected command execution patterns may also aid in early detection of exploitation attempts.
From a threat intelligence perspective, this type of vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically sub-techniques related to shell commands like sh or bash (T1059.004). Attackers frequently target IoT devices using automated scanners that probe for known command injection vectors in common CGI endpoints. The presence of such flaws in 5G gateways is particularly concerning as these devices often serve as the primary gateway between a private network and the cellular wide area network, making them high-value targets for both criminal enterprises seeking botnet recruitment and state-sponsored actors aiming to establish persistent access points within critical infrastructure or enterprise networks.