Authentication Bypass Vulnerability in WNC T-Mobile 5G Box IDU Router
CVE-2026-40854

8.7HIGH

Key Information:

Vendor

Wnc

Status
T-mobile 5g Box Idu
Vendor
CVE Published:
16 September 2026

What is CVE-2026-40854?

The WNC T-Mobile 5G Box IDU router is susceptible to an authentication bypass flaw in the portal.cgi component, which undermines session verification mechanisms. The vulnerability arises from improper validation of the sessionid cookie, where directory traversal sequences (e.g., '.' or '..') can be exploited by an attacker. This allows unauthorized access to the router's administration panel, potentially compromising sensitive configurations and data. Affected users are urged to upgrade to firmware version 1.1.0.651412 to rectify this security issue.

Affected Version(s)

T-Mobile 5G Box IDU 0 < 1.1.0.651412

References

https://cert.pl/posts/2026/09/CVE-2026-40854
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Patryk Bogdan
Adam Borczyk
.