Vulnerabilities in WNC T-Mobile 5G Box IDU routers

CERT Polska has received a report about vulnerabilities in firmware of WNC (Wistron NeWeh Corporation) T-Mobile 5G Box IDU routers and participated in coordination of their disclosure.

The vulnerabilityCVE-2026-40854: WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates thesessionidcookie by checking for the existence of a corresponding file in/tmp/login_user. An attacker can bypass authentication by using directory entries such as "." or ".." in the cookie, allowing unauthorized access to the administration panel.

The vulnerabilityCVE-2026-40855: WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the/cgi-bin/portal.cgiendpoint, specifically affecting theping_ip,ping_size, andping_timesPOST parameters. The root cause is the failure to verify and sanitize user-supplied input before incorporating it into a system command. This allows an authenticated attacker to execute arbitrary commands on the shell and gain root access to the system.

The vulnerabilityCVE-2026-40856: WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in thewnc_maccheck.cgiendpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi passphrase, and technical device information.

The vulnerabilityCVE-2026-40857: WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate thecsrf_token_valueparameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.

The vulnerabilityCVE-2026-58146: WNC T-Mobile 5G Box IDU router is vulnerable to a OS command injection vulnerability. The vulnerability exists within the/cgi-bin/portal.cgiendpoint, specifically through thecli_cookiePOST parameter. Thecli_cookieparameter value is directly concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root on the underlying operating system.

The vulnerabilityCVE-2026-58147: WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in thehttp_passwd_hiddenandhttp_passwdConfirm_hiddenparameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.

These issues have been fixed in firmware version 1.1.0.651412

We thank Patryk Bogdan and Adam Borczyk for the responsible vulnerability report.