T-Mobile 5G Box IDU vulnerabilities

6 known vulnerabilities in T-Mobile 5G Box IDU from WNC. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  T-Mobile 5G Box IDU: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-58147Sep 16, 2026WNCEPSS 1.58%

  WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameter

• 9.4 Critical severity

  T-Mobile 5G Box IDU: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-58146Sep 16, 2026WNCEPSS 2.89%

  WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated in

• 8.4 High severity

  T-Mobile 5G Box IDU: Cross-Site Request Forgery

  CVE-2026-40857Sep 16, 2026WNC

  WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attack

• 7.1 High severity

  T-Mobile 5G Box IDU: Missing Authentication for Critical Functionality

  CVE-2026-40856Sep 16, 2026WNC

  WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the

• 9.3 Critical severity

  T-Mobile 5G Box IDU: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-40855Sep 16, 2026WNCEPSS 1.59%

  WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root cause is th

• 8.7 High severity

  T-Mobile 5G Box IDU: Authentication Bypass by Spoofing

  CVE-2026-40854Sep 16, 2026WNC

  WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/login_user. A