CVE-2026-58146

CVE-2026-58146

WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly concatenated into a find command string without proper sanitization. This allows a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root on the underlying operating system. This issue has been fixed in firmware version 1.1.0.651412

Vulnerability class: Command Injection (OS Command Injection)

Published · last modified .

EPSS exploit prediction

EPSS: 0.029 (86.9th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 86.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-58146: held from 0.029 to 0.029.

EPSS over last 30 days · oldest: 0.029 · newest: 0.029 · change: 0.000

Weakness classification (CWE)

References