CVE-2026-40856 WNC CVE debrief

Who should care

Defenders responsible for WNC T-Mobile 5G Box IDU router deployments should assess exposure and prioritize upgrading to the fixed firmware version. This includes verifying exposure by checking router firmware version and configuration, and restricting access to the vulnerable endpoint. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-40856 allows unauthorized access to sensitive configuration data on WNC T-Mobile 5G Box IDU routers. Defenders should verify exposure, prioritize upgrading to fixed firmware, and restrict access to the vulnerable endpoint.

• Verify exposure by checking router firmware version and configuration
• Upgrade to firmware version 1.1.0.651412 or later to prevent unauthorized access
• Restrict access to the wnc_maccheck.cgi endpoint to prevent data retrieval

Technical summary

The WNC T-Mobile 5G Box IDU router has a vulnerability in the wnc_maccheck.cgi endpoint, allowing unauthorized access to sensitive configuration data, including administrator web password, WiFi passphrase, and technical device information. This issue has been fixed in firmware version 1.1.0.651412. The vulnerability exists due to improper access control, allowing remote attackers to retrieve sensitive information without authentication. Defenders should prioritize verifying exposure and upgrading to the fixed firmware version.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to fixed firmware version 1.1.0.651412.

Recommended defensive actions

• Verify exposure by checking router firmware version and configuration
• Upgrade to firmware version 1.1.0.651412 or later
• Restrict access to the wnc_maccheck.cgi endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the wnc_maccheck.cgi endpoint, accessible without authentication, allowing retrieval of sensitive configuration data, including administrator web password, WiFi passphrase, and technical device information. The issue has been confirmed in firmware versions prior to 1.1.0.651412. Defenders should verify exposure by checking router firmware version and configuration.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.