CVE-2026-58147 — Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers

CVE-2026-58147

Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers PUBLISHED

Description (CNA)

WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version 1.1.0.651412

Affected (CNA)

Vendor / product	Versions
WNC / T-Mobile 5G Box IDU	affected 0 before 1.1.0.651412

CWE

CWE-78

References

https://cert.pl/posts/2026/09/CVE-2026-40854

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.