Improper Access Control in WNC T-Mobile 5G Box IDU Router
CVE-2026-40856

7.1HIGH

Key Information:

Vendor

Wnc

Status
T-mobile 5g Box Idu
Vendor
CVE Published:
16 September 2026

What is CVE-2026-40856?

The WNC T-Mobile 5G Box IDU router has a security flaw that involves improper access control in the wnc_maccheck.cgi endpoint. This vulnerability allows remote attackers to bypass authentication, leading to the potential exposure of sensitive configuration details, such as the administrator web password, WiFi passphrase, and various device-specific technical information. Users are advised to update to firmware version 1.1.0.651412 or later to mitigate this risk.

Affected Version(s)

T-Mobile 5G Box IDU 0 < 1.1.0.651412

References

https://cert.pl/posts/2026/09/CVE-2026-40854

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Patryk Bogdan
Adam Borczyk
.