CVE-2026-40857

UNKNOWN 0.0

CSRF token bypass in T-Mobile 5G Box IDU routers

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.This issue has been fixed in firmware version 1.1.0.651412

CWE	CWE-352
Vendor	wnc
Product	t-mobile 5g box idu
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for wnc t-mobile 5g box idu

Be the first to know when new unknown vulnerabilities affecting wnc t-mobile 5g box idu are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

WNC / T-Mobile 5G Box IDU

0 < 1.1.0.651412

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/posts/2026/09/CVE-2026-40854

Credits

Patryk Bogdan Adam Borczyk