Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-40857

CSRF token bypass in T-Mobile 5G Box IDU routers

CVSS 4.0 8.4 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-40857

Published

WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.This issue has been fixed in firmware version 1.1.0.651412

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-40857

Published

T-Mobile 5G Box IDU

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "WNC",
                    "product": "T-Mobile 5G Box IDU",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "1.1.0.651412",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON