Adam Borczyk

**Name of the Vulnerable Software and Affected Versions** WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 **Description** The `portal.cgi` component contains two security issues. First, an authentication bypass exists because the session verification mechanism improperly validates the `sessionid` cookie by checking for a file in `/tmp/login user`. An attacker can gain unauthorized access to the administration panel by using directory entries like `.` or `..` in the cookie. Second, an OS command injection exists in the password change functionality. The application fails to neutralize special elements in the `http passwd hidden` and `http passwdConfirm hidden` parameters, allowing an authenticated attacker to execute arbitrary commands on the operating system with root privileges. **Recommendations** Update to firmware version 1.1.0.651412.

**Name of the Vulnerable Software and Affected Versions** WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 **Description** An authenticated attacker can execute arbitrary commands on the shell and gain root access to the system due to a command injection flaw. The issue occurs in the ping functionality within the '/cgi-bin/portal.cgi' endpoint when the system fails to verify and sanitize user-supplied input before incorporating it into a system command. The affected POST parameters are `ping ip`, `ping size`, and `ping times`. **Recommendations** Update to firmware version 1.1.0.651412. Avoid using the `ping ip`, `ping size`, and `ping times` parameters in the '/cgi-bin/portal.cgi' endpoint as a temporary mitigation.

**Name of the Vulnerable Software and Affected Versions** WNC T-Mobile 5G Box IDU versions prior to 1.1.0.651412 **Description** Improper access control allows a remote attacker to access the 'wnc maccheck.cgi' endpoint without authentication. This enables the retrieval of sensitive configuration data, such as the administrator web password, WiFi passphrase, and technical device information. **Recommendations** Update to firmware version 1.1.0.651412.

**Name of the Vulnerable Software and Affected Versions** WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 **Description** A cross-site request forgery (CSRF) issue exists in the 'portal.cgi' component. The anti-CSRF mechanism fails to validate the `csrf token value` parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website. CSRF is a type of attack that forces an authenticated user to execute unwanted actions on a web application in which they are currently authenticated. **Recommendations** Update to firmware version 1.1.0.651412.

**Name of the Vulnerable Software and Affected Versions** WNC T-Mobile 5G Box IDU versions prior to 1.1.0.651412 **Description** An OS command injection flaw exists in the '/cgi-bin/portal.cgi' endpoint. The issue occurs because the `cli cookie` POST parameter is concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to execute arbitrary shell commands with root privileges on the operating system. **Recommendations** Update to firmware version 1.1.0.651412. Avoid using the `cli cookie` parameter in the '/cgi-bin/portal.cgi' endpoint as a temporary mitigation.

**Name of the Vulnerable Software and Affected Versions** WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 **Description** The password change functionality within the 'portal.cgi' component contains an OS command injection flaw. The application fails to properly neutralize special elements in the `http passwd hidden` and `http passwdConfirm hidden` parameters. This allows an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges. **Recommendations** Update to firmware version 1.1.0.651412.