CVE-2026-58146

The WNC T-Mobile 5G Box IDU router contains an unauthenticated OS command injection flaw (CWE-78) in its /cgi-bin/portal.cgi web portal endpoint. The cli_cookie POST parameter is concatenated directly into a shell find command without sanitization, so a crafted POST request allows an attacker to append and execute arbitrary shell commands. Successful exploitation yields command execution as root on the underlying operating system, giving full control of the gateway and the traffic it handles. Per the CVSS 4.0 vector (AV:A), exploitation requires an attacker positioned on the network adjacent to the router, such as a device on its Wi-Fi or LAN, with no credentials or user interaction needed. All firmware prior to 1.1.0.651412 is affected; no public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is currently known.

What to do: Upgrade the router to firmware version 1.1.0.651412 or later. Until updated, do not expose the management portal (/cgi-bin/portal.cgi) to the WAN and restrict LAN/Wi-Fi access to trusted devices. Check device logs for unexpected POST requests to /cgi-bin/portal.cgi containing a cli_cookie parameter, which may indicate exploitation attempts.