Full Report
CERT Polska has received a report about 6 vulnerabilities (CVE-2026-58146, CVE-2026-58147 and from CVE-2026-40854 to CVE-2026-40857) found in firmware of WNC T-Mobile 5G Box IDU routers.
Analysis Summary
# Vulnerability: Multiple Flaws in WNC T-Mobile 5G Box IDU Firmware
## CVE Details
* **CVE-2026-58146**: CVSS Score: N/A (OS Command Injection - CWE-78)
* **CVE-2026-58147**: CVSS Score: N/A (OS Command Injection - CWE-78)
* **CVE-2026-40854**: CVSS Score: N/A (Authentication Bypass - CWE-290)
* **CVE-2026-40855**: CVSS Score: N/A (OS Command Injection - CWE-78)
* **CVE-2026-40856**: CVSS Score: N/A (Missing Authentication for Critical Function - CWE-306)
* **CVE-2026-40857**: CVSS Score: N/A (Cross-Site Request Forgery - CWE-352)
*(Note: Specific CVSS decimal scores were not provided in the source text, but the technical descriptions indicate High to Critical severity for several flaws.)*
## Affected Systems
* **Products**: WNC (Wistron NeWeb Corporation) T-Mobile 5G Box IDU routers.
* **Versions**: All firmware versions prior to **1.1.0.651412**.
* **Configurations**: Default configurations are affected, particularly those with the web management portal accessible.
## Vulnerability Description
The firmware contains six distinct vulnerabilities ranging from session management flaws to command execution:
1. **Auth Bypass (CVE-2026-40854)**: The `portal.cgi` component improperly validates the `sessionid` cookie by checking for file existence. Attackers can use directory traversal (e.g., `.` or `..`) to bypass login.
2. **Command Injection (CVE-2026-58146)**: An unauthenticated flaw where the `cli_cookie` POST parameter is concatenated into a `find` command without sanitization, allowing root shell execution.
3. **Information Disclosure (CVE-2026-40856)**: The `wnc_maccheck.cgi` endpoint lacks authentication, allowing anyone to retrieve the administrator password, WiFi passphrase, and device technical info.
4. **Authenticated Command Injections (CVE-2026-40855, CVE-2026-58147)**: Flaws in the ping functionality and password change functionality allow authenticated users to execute root commands via unsanitized POST parameters.
5. **CSRF (CVE-2026-40857)**: The system fails to validate `csrf_token_value`, allowing attackers to perform actions on behalf of a logged-in user.
## Exploitation
* **Status**: Not explicitly reported as exploited in the wild; however, the technical details provided are sufficient for PoC development.
* **Complexity**: Low. Several flaws (Command Injection and Info Disclosure) require minimal effort.
* **Attack Vector**: Network (Remote) / Adjacent.
## Impact
* **Confidentiality**: **High**. Attackers can retrieve plain-text admin credentials and WiFi passwords.
* **Integrity**: **High**. Unauthorized command execution as root allows full system modification.
* **Availability**: **High**. Potential for device takeover or bricking via arbitrary command execution.
## Remediation
### Patches
* Update firmware to version **1.1.0.651412** or later. Users should check the T-Mobile management interface for available over-the-air (OTA) updates.
### Workarounds
* Disable remote management (WAN-side access) to the router’s web interface.
* Ensure the local network is trusted and limit access to the router's IP address.
* Avoid visiting suspicious websites while logged into the router administration panel to mitigate CSRF risks.
## Detection
* **Indicators of Compromise**:
* Unexpected entries in `/tmp/login_user`.
* Unusual POST requests to `/cgi-bin/portal.cgi` containing shell metacharacters (`;`, `|`, `&`, `` ` ``) in parameters like `cli_cookie` or `ping_ip`.
* Unauthorized access logs for `wnc_maccheck.cgi`.
* **Detection Methods**: Monitor network traffic for directory traversal sequences in cookies and shell injection patterns in CGI parameters.
## References
* CERT Polska Advisory: [hXXps://cert[.]pl/en/posts/2026/09/vulnerabilities-in-wnc-t-mobile-5g-box-idu-routers/]
* CVE Details: [hXXps://www[.]cve[.]org/CVERecord?id=CVE-2026-40854]
* CWE Definitions: [hXXps://cwe[.]mitre[.]org/data/definitions/78[.]html]