CVE-2026-581479.3CriticalCWE-78
Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers
WNC · T-Mobile 5G Box IDU
Not in CISA KEVVendor fix available
1.6%probability of exploitation in the next 30 days
75th percentile
050100
Higher than 75% of scored CVEs
9.3CriticalCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version 1.1.0.651412
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 17 Sep.
- Critical WNC flaws expose T-Mobile 5G Box routers to attacksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.