CVE-2026-58146: WNC T-Mobile 5G Box IDU RCE Vulnerability

CVE-2026-58146 Overview

CVE-2026-58146 is an operating system command injection vulnerability [CWE-78] affecting the WNC T-Mobile 5G Box IDU router. The flaw resides in the /cgi-bin/portal.cgi endpoint, where the cli_cookie POST parameter is concatenated into a find command string without sanitization. A remote, unauthenticated attacker on an adjacent network can inject arbitrary shell commands that execute as root. The vendor has fixed the issue in firmware version 1.1.0.651412.

Critical Impact
Unauthenticated attackers on the adjacent network can execute arbitrary shell commands as root on the router, gaining full control of the device and any traffic traversing it.

Affected Products

WNC T-Mobile 5G Box IDU router (firmware prior to 1.1.0.651412)
Vulnerable endpoint: /cgi-bin/portal.cgi
Vulnerable parameter: cli_cookie (POST)

Discovery Timeline

2026-09-16 - CVE-2026-58146 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-58146

Vulnerability Analysis

The router exposes a web management interface handled by /cgi-bin/portal.cgi. When the endpoint receives a POST request, it reads the cli_cookie parameter and inserts the value directly into a shell command line that invokes find. Because the value is concatenated as a string, shell metacharacters such as backticks, semicolons, and $() are interpreted by the underlying shell. An attacker can append arbitrary commands to the find invocation and have them executed by the CGI process, which runs as root.

The vulnerability requires no authentication and no user interaction. Access is limited to the adjacent network, which typically means the LAN or Wi-Fi segment served by the router itself.

Root Cause

The root cause is missing input sanitization on a CGI parameter that is passed to a shell interpreter. The cli_cookie value should be validated against an allowlist or passed as an argument to execve without shell interpretation. Instead, the handler builds the command through string concatenation, mapping the classic pattern described in CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

An attacker sends a crafted HTTP POST to /cgi-bin/portal.cgi with a cli_cookie value containing shell metacharacters and injected commands. The CGI handler executes the concatenated command, and the injected payload runs with root privileges. Successful exploitation permits credential theft, firmware modification, pivoting into the internal network, and interception of subscriber traffic. See the CERT Poland analysis for related technical detail.

Detection Methods for CVE-2026-58146

Indicators of Compromise

POST requests to /cgi-bin/portal.cgi containing shell metacharacters (;, |, `, $(, &&) in the cli_cookie parameter.
Unexpected child processes of the web server or CGI handler, particularly shells, wget, curl, tftp, nc, or busybox invocations.
New or modified files under /tmp, /var, or persistent configuration paths on the router.
Outbound connections from the router to unfamiliar hosts shortly after HTTP requests to the management interface.

Detection Strategies

Inspect HTTP request logs on the router or upstream network sensors for POST bodies targeting portal.cgi with non-cookie-shaped values in cli_cookie.
Alert on any process spawned by the CGI handler that is not part of its normal execution profile.
Correlate management-interface access from unusual internal hosts with subsequent DNS or outbound traffic anomalies from the router itself.

Monitoring Recommendations

Forward router syslog and web-server access logs to a central log store and retain them for incident review.
Monitor firmware version and configuration integrity through periodic checks against the patched version 1.1.0.651412.
Track adjacent-network scanning behavior that targets TCP/80 or TCP/443 on customer premises equipment.

How to Mitigate CVE-2026-58146

Immediate Actions Required

Upgrade affected WNC T-Mobile 5G Box IDU routers to firmware version 1.1.0.651412 or later.
Restrict access to the router management interface to trusted administrative hosts only.
Disable remote management on the WAN interface if it is enabled.
Rotate any credentials, pre-shared keys, or certificates stored on devices that may have been exposed prior to patching.

Patch Information

The vendor has released firmware 1.1.0.651412, which addresses the command injection by properly sanitizing the cli_cookie parameter before it reaches the find command. Refer to the CERT Poland advisory for coordinated disclosure detail and vendor references.

Workarounds

Place the router behind a network segment that blocks unsolicited HTTP traffic to /cgi-bin/portal.cgi from untrusted clients.
Apply firewall rules on the LAN to allow management-interface access only from a dedicated administrative VLAN or host.
Disable Wi-Fi access to the management interface where the device supports separating management and client traffic.

bash

# Example: restrict access to the router management interface
# Replace 192.0.2.10 with the authorized admin host and 192.168.1.1 with the router IP
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 80  -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 80  -j DROP
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 443 -j DROP