CVE-2026-58146

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU versions prior to 1.1.0.651412

Description An OS command injection flaw exists in the '/cgi-bin/portal.cgi' endpoint. The issue occurs because the cli cookie POST parameter is concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to execute arbitrary shell commands with root privileges on the operating system.

Recommendations Update to firmware version 1.1.0.651412. Avoid using the cli cookie parameter in the '/cgi-bin/portal.cgi' endpoint as a temporary mitigation.