Cross-Site Request Forgery Vulnerability in WNC T-Mobile 5G Box Router
CVE-2026-40857

8.4HIGH

Key Information:

Vendor

Wnc

Status
T-mobile 5g Box Idu
Vendor
CVE Published:
16 September 2026

What is CVE-2026-40857?

The WNC T-Mobile 5G Box IDU router is susceptible to a cross-site request forgery (CSRF) vulnerability, found in the portal.cgi component. The device's anti-CSRF mechanism inadequately validates the csrf_token_value parameter, mistakenly accepting any arbitrary value as valid. This loophole can be exploited by a remote attacker, who might trick an authenticated user into visiting a malicious site, leading to unauthorized actions on the router.

Affected Version(s)

T-Mobile 5G Box IDU 0 < 1.1.0.651412

References

https://cert.pl/posts/2026/09/CVE-2026-40854
third-party-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Patryk Bogdan
Adam Borczyk
.