CVE-2026-58146 in T-Mobile 5G Box IDU
Summary
by MITRE • 09/16/2026
WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root on the underlying operating system.
This issue has been fixed in firmware version 1.1.0.651412
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The WNC T-Mobile 5G Box IDU router contains a critical OS command injection vulnerability located within its web management interface, specifically affecting the /cgi-bin/portal.cgi endpoint. This flaw arises from improper input validation and sanitization practices in the handling of the cli_cookie POST parameter. When this parameter is processed by the backend application logic, its value is directly concatenated into a shell find command string without any filtering or escaping mechanisms to neutralize special characters or control sequences. This architectural weakness creates a direct pathway for remote code execution, as the underlying operating system interprets injected commands alongside legitimate operations.
The technical nature of this vulnerability classifies it under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. An attacker can exploit this flaw by crafting a malicious HTTP POST request to the vulnerable endpoint and injecting shell metacharacters such as semicolons or pipe symbols into the cli_cookie field. Because the application fails to sanitize these inputs before passing them to the system interpreter, the injected commands are executed with the privileges of the process running the web server. In many embedded router environments, this service runs with root-level permissions, granting the attacker full administrative control over the device's operating system.
The operational impact of this vulnerability is severe and comprehensive. A remote, unauthenticated attacker can exploit this flaw to execute arbitrary commands on the target device without any prior authentication or user interaction beyond sending a network packet. This capability allows for complete compromise of the router's confidentiality, integrity, and availability. Attackers may use this access to exfiltrate sensitive data such as customer credentials, network configuration details, or connected device information. Furthermore, they can modify system configurations, install persistent backdoors, pivot into internal networks by manipulating routing tables or firewall rules, or disrupt service by crashing the operating system. This aligns with ATT&CK techniques related to Command and Scripting Interpreter abuse and Remote Services exploitation, highlighting the potential for lateral movement within a protected network environment.
To mitigate this risk, immediate action is required to update the firmware on all affected devices. The vendor has released version 1.1.0.651412 which addresses this vulnerability by implementing proper input validation and sanitization routines before any user-supplied data is passed to system commands. Administrators should verify that their deployed units are running at least this patched version. In environments where immediate patching is not feasible, temporary mitigations include restricting access to the management interface via IP whitelisting or disabling remote administration features entirely until the firmware update can be applied. Regular security audits and adherence to secure coding standards such as OWASP guidelines for input validation are essential preventive measures against similar injection flaws in embedded systems.