CVE-2026-40854 WNC CVE debrief

Who should care

Defenders responsible for the WNC T-Mobile 5G Box IDU router should verify exposure and apply the firmware update to prevent unauthorized access to the administration panel. They should also monitor for suspicious activity on the administration panel and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

The authentication bypass vulnerability in the WNC T-Mobile 5G Box IDU router allows unauthorized access to the administration panel, which can lead to potential security breaches.

• Verify exposure by checking the firmware version of the WNC T-Mobile 5G Box IDU router
• Apply the firmware update to version 1.1.0.651412 or later
• Monitor for suspicious activity on the administration panel

Technical summary

The WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. An attacker can bypass authentication by manipulating the sessionid cookie, allowing unauthorized access to the administration panel. The vulnerability is caused by improper validation of the sessionid cookie, which allows an attacker to access the administration panel without proper authentication. This issue has been fixed in firmware version 1.1.0.651412. Defenders should prioritize verifying exposure and applying the firmware update to prevent unauthorized access to the administration panel.

Defensive priority

Defenders should prioritize verifying exposure and applying the firmware update to prevent unauthorized access to the administration panel.

Recommended defensive actions

• Verify exposure by checking the firmware version of the WNC T-Mobile 5G Box IDU router
• Apply the firmware update to version 1.1.0.651412 or later
• Monitor for suspicious activity on the administration panel
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the authentication bypass vulnerability in the WNC T-Mobile 5G Box IDU router. The vulnerability is caused by improper validation of the sessionid cookie, allowing an attacker to bypass authentication. The CVE record and NVD page also provide information on the affected product and the fixed firmware version. To verify exposure, defenders should check the firmware version of the WNC T-Mobile 5G Box IDU router and apply the firmware update to version 1.1.0.651412.0

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.