CVE-2026-58147

WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version 1.1.0.651412

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/09/CVE-2026-40854

Configurations

No configuration.

History

28 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El router WNC T-Mobile 5G Box IDU contiene una vulnerabilidad de inyección de comandos del sistema operativo en la funcionalidad de cambio de contraseña del componente portal.cgi. La aplicación neutraliza incorrectamente elementos especiales en los parámetros http_passwd_hidden y http_passwdConfirm_hidden, permitiendo a un atacante autenticado ejecutar comandos arbitrarios en el sistema operativo subyacente con privilegios de root. Este problema ha sido solucionado en la versión de firmware 1.1.0.651412.

16 Sep 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-16 12:17

Updated : 2026-09-28 23:10

NVD link : CVE-2026-58147

Mitre link : CVE-2026-58147

CVE.ORG link : CVE-2026-58147

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-58147", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58147", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-16T15:53:03.720050Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "WNC", "product": "T-Mobile 5G Box IDU", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.0.651412", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T12:17:05.103", "references": [{"url": "https://cert.pl/posts/2026/09/CVE-2026-40854", "source": "cvd@cert.pl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "WNC T-Mobile 5G Box IDU router\u00a0contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version\u00a01.1.0.651412"}, {"lang": "es", "value": "El router WNC T-Mobile 5G Box IDU contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en la funcionalidad de cambio de contrase\u00f1a del componente portal.cgi. La aplicaci\u00f3n neutraliza incorrectamente elementos especiales en los par\u00e1metros http_passwd_hidden y http_passwdConfirm_hidden, permitiendo a un atacante autenticado ejecutar comandos arbitrarios en el sistema operativo subyacente con privilegios de root. Este problema ha sido solucionado en la versi\u00f3n de firmware 1.1.0.651412."}], "lastModified": "2026-09-28T23:10:00.143", "sourceIdentifier": "cvd@cert.pl"}