Command Injection Vulnerability in WNC T-Mobile 5G Box IDU Router
CVE-2026-40855

9.3CRITICAL

Key Information:

Vendor

Wnc

Status
T-mobile 5g Box Idu
Vendor
CVE Published:
16 September 2026

What is CVE-2026-40855?

The WNC T-Mobile 5G Box IDU router contains a command injection vulnerability in its ping functionality located within the /cgi-bin/portal.cgi endpoint. This issue arises from inadequate validation and sanitization of user input within the ping_ip, ping_size, and ping_times POST parameters. An authenticated attacker can exploit this flaw to execute arbitrary commands on the system shell, potentially leading to unauthorized root access. This vulnerability has been addressed in firmware version 1.1.0.651412.

Affected Version(s)

T-Mobile 5G Box IDU 0 < 1.1.0.651412

References

https://cert.pl/posts/2026/09/CVE-2026-40854
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Patryk Bogdan
Adam Borczyk
.