Critical WNC flaws expose T-Mobile 5G Box routers to attacks

CERT Polska has disclosed six vulnerabilities in Wistron NeWeb Corporation (WNC) routers supplied as T-Mobile 5G Box devices. The flaws comprise three critical and three high-severity issues, with CVSSv4 scores ranging from 7.1 to 9.4. The most serious, CVE-2026-58146, is rated 9.4 and enables unauthorised remote code execution.

Other issues include command injection through the ping function (CVE-2026-40855), remote code execution through the password-change function (CVE-2026-58147), session authentication bypass using a manipulated cookie (CVE-2026-40854), CSRF-token bypass (CVE-2026-40857) and configuration disclosure (CVE-2026-40856).

According to the report, attackers exploiting CVE-2026-40854 can access the administration panel by manipulating the `sessionid` cookie with directory-traversal characters. The command-injection flaws can allow supplied shell commands to run with root privileges, while CVE-2026-40856 may expose Wi-Fi passphrases and administrator passwords. The affected devices are WNC T-Mobile 5G Box IDU routers running firmware older than 1.1.0.651412. No active exploitation or public proof-of-concept code has been confirmed.

WNC fixed the vulnerabilities in firmware version 1.1.0.651412. Device owners should contact their service provider to confirm that the update has been installed, particularly where firmware updates are delivered automatically, and should change default passwords.