CVE-2026-40855 WNC CVE debrief

Who should care

System administrators and security teams responsible for WNC T-Mobile 5G Box IDU routers should assess exposure and prioritize verification and remediation. They must verify if systems are running firmware version 1.1.0.651412 or later and apply the firmware update if vulnerable. Additionally, they should monitor system logs for suspicious activity and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-40855 is a critical vulnerability in the WNC T-Mobile 5G Box IDU router, allowing authenticated command injection. System administrators and security teams must assess exposure, prioritize verification, and apply the firmware update to prevent exploitation.

• Authenticated attackers can execute arbitrary commands as root
• Potential for lateral movement and further exploitation
• Need for immediate firmware update and system verification
• Possible impact on network integrity and data confidentiality

Technical summary

The WNC T-Mobile 5G Box IDU router's /cgi-bin/portal.cgi endpoint is vulnerable to command injection via the ping_ip, ping_size, and ping_times POST parameters. An authenticated attacker can execute arbitrary commands as root due to insufficient input sanitization. This issue has been fixed in firmware version 1.1.0.651412. System administrators and security teams should assess exposure, prioritize verification of affected systems, and apply the firmware update to prevent exploitation. The vulnerability has a CVSS score of 9.3, indicating a critical severity level.

Defensive priority

High

Recommended defensive actions

• Assess exposure of WNC T-Mobile 5G Box IDU routers in your environment
• Verify if systems are running firmware version 1.1.0.651412 or later
• Apply the firmware update if vulnerable
• Monitor system logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the affected product. However, the vendor and product names are not specified, which may limit the scope of affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.