CVE-2026-58146CWE-78command-injection

CVE-2026-58146

published September 16, 2026

CVSS
9.4
EPSS
3%
Percentile
86.8
In the wild
Unconfirmed
What it is

WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root on the underlying operating system.

This issue has been fixed in firmware version 1.1.0.651412

The record
Technical detail
CVSS
9.4 · NONE
CVSS v4.0
9.4 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.02889 · 86.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-16T16:17Z
References (1)
https://cert.pl/posts/2026/09/CVE-2026-40854 · [email protected]
EPSS history
Timeline
  • 18 SEP 04:00Z
    EPSS moved — → 2%
    epss
  • 16 SEP 11:21Z
    Unauthorized remote code execution in T-Mobile 5G Box IDU routers
    cvelistv5