CVE-2026-58147CWE-78command-injection

CVE-2026-58147

published September 16, 2026

CVSS
9.3
EPSS
2%
Percentile
75.3
In the wild
Unconfirmed
What it is

WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version 1.1.0.651412

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01579 · 75.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-16T16:17Z
References (1)
https://cert.pl/posts/2026/09/CVE-2026-40854 · [email protected]
EPSS history
Timeline
  • 18 SEP 04:00Z
    EPSS moved — → 1%
    epss
  • 16 SEP 11:21Z
    Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers
    cvelistv5