Loading vulnerability…
Authentication Bypass in WNC T-Mobile 5G Box IDU Router
CVE-2026-40854 is an authentication-bypass vulnerability in the web administration component of WNC T-Mobile 5G Box IDU routers running firmware earlier than 1.1.0.651412. Session validation derives a filesystem existence check from the client-supplied session identifier cookie. Directory-entry values, including "." or "..", satisfy this check without a valid authenticated session, allowing access to the administration panel.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can access the router's web administration panel. This exposes administrative functionality and may enable unauthorized viewing or modification of router configuration, with consequent compromise of device confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
Until firmware is upgraded, restrict access to the router web administration interface to trusted local management networks. Prevent untrusted hosts from reaching the management service, including through WAN-side administration controls, network segmentation, and firewall policy.
Patch, then assume compromise.
Upgrade affected WNC T-Mobile 5G Box IDU routers to firmware version 1.1.0.651412 or later, which corrects the session-validation flaw.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.