CVE-2026-40857 WNC CVE debrief

Who should care

Defenders responsible for WNC T-Mobile 5G Box IDU routers should assess exposure and prioritize upgrading to firmware version 1.1.0.651412 if vulnerable. Security teams and vulnerability management teams should review the CVE record and NVD vulnerability detail to understand the impact of the CSRF vulnerability. Operators and administrators of WNC T-Mobile 5G Box IDU routers should verify the exposure of their systems and take necessary actions to mitigate

Why it matters

Defenders should prioritize verifying exposure of WNC T-Mobile 5G Box IDU routers and upgrading to firmware version 1.1.0.651412 if vulnerable, as the CSRF vulnerability allows remote attackers to perform unauthorized actions on the device.

• Remote attackers can perform unauthorized actions on the device
• Authenticated users may be tricked into visiting malicious websites
• Device compromise may occur if not upgraded to firmware version 1.1.0.651412

Technical summary

The WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website. The vulnerability impacts the confidentiality, integrity, and availability of the device. Defenders should prioritize verifying exposure of WNC T-Mobile 5G Box IDU routers and upgrading to firmware version 1.1.0.651412 if vulnerable.

Defensive priority

Defenders should prioritize verifying exposure of WNC T-Mobile 5G Box IDU routers and upgrading to firmware version 1.1.0.651412 if vulnerable.

Recommended defensive actions

• Verify exposure of WNC T-Mobile 5G Box IDU routers in the environment
• Upgrade to firmware version 1.1.0.651412 if vulnerable
• Monitor for suspicious activity on the device
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the CSRF vulnerability in the WNC T-Mobile 5G Box IDU router. A source reference from cert.pl is also available. Defenders should verify the exposure of WNC T-Mobile 5G Box IDU routers and review the firmware version. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This vulnerability allows remote attackers to perform unauthorized actions on the device by tricking an authenticated user into visiting a a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.