CVE-2026-58147 WNC CVE debrief

Who should care

Defenders responsible for WNC T-Mobile 5G Box IDU routers should assess exposure and prioritize upgrading to firmware version 1.1.0.651412 if vulnerable. This includes operators managing the affected routers, platform administrators, and security teams responsible for vulnerability management and remediation.

Why it matters

The OS command injection vulnerability in the WNC T-Mobile 5G Box IDU router allows authenticated attackers to execute arbitrary commands with root privileges, requiring defenders to verify exposure and prioritize upgrading to firmware version 1.1.0.651412.

• Authenticated attackers may execute arbitrary commands with root privileges
• Defenders must verify exposure and upgrade vulnerable routers
• Potential exploitation attempts require monitoring

Technical summary

The WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. An authenticated attacker can execute arbitrary commands on the underlying operating system with root privileges due to improper neutralization of special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters. This issue has been fixed in firmware version 1.1.0.651412. The vulnerability allows attackers to execute arbitrary commands, potentially leading to unauthorized access and control.

Defensive priority

Defenders should prioritize verifying exposure of WNC T-Mobile 5G Box IDU routers and upgrading to firmware version 1.1.0.651412 if vulnerable.

Recommended defensive actions

• Verify exposure of WNC T-Mobile 5G Box IDU routers in the environment
• Upgrade to firmware version 1.1.0.651412 if vulnerable
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the OS command injection vulnerability in the WNC T-Mobile 5G Box IDU router. The vulnerability allows authenticated attackers to execute arbitrary commands with root privileges due to improper neutralization of special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters. Defenders should verify exposure and prioritize upgrading to firmware version 1.1.0.651412. The source detail is limited, and defenders should explicitly verify the affected W

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.