CVE-2026-40855CWE-78command-injection

CVE-2026-40855

published September 16, 2026

CVSS
9.3
EPSS
2%
Percentile
75.5
In the wild
Unconfirmed
What it is

WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root cause is the failure to verify and sanitize user-supplied input before incorporating it into a system command. This allows an authenticated attacker to execute arbitrary commands on the shell and gain root access to the system.This issue has been fixed in firmware version 1.1.0.651412

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01592 · 75.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-16T16:17Z
References (1)
https://cert.pl/posts/2026/09/CVE-2026-40854 · [email protected]
EPSS history
Timeline
  • 18 SEP 03:59Z
    EPSS moved — → 1%
    epss
  • 16 SEP 11:21Z
    Command Injection in T-Mobile 5G Box IDU router via ping functionality
    cvelistv5