CVE-2026-58147

— UNSCORED

Published 2026-09-16 · Updated 2026-09-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges.This issue has been fixed in firmware version 1.1.0.651412

Weaknesses

CWE-78

References

https://cert.pl/posts/2026/09/CVE-2026-40854

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.