Loading vulnerability…
Authenticated Command Injection in WNC T-Mobile 5G Box IDU Ping Function
CVE-2026-40855 is an OS command-injection vulnerability in the ping diagnostic functionality of WNC T-Mobile 5G Box IDU routers running firmware versions earlier than 1.1.0.651412. User-controlled ping destination, packet-size, and repetition-count values are incorporated into a system command without sufficient validation or sanitization. An authenticated attacker can inject arbitrary shell commands, which execute with root privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary command execution as root on the affected router. An attacker could fully compromise the device, alter its configuration, establish persistence, intercept or redirect network traffic, and use the router as a pivot into connected networks.
If you can’t patch tonight, do this now.
Until the firmware update is deployed, restrict administrative-interface access to trusted administrators and management networks only. Limit remote management exposure, enforce strong unique administrator credentials, and disable or restrict access to ping diagnostics where operationally feasible.
Patch, then assume compromise.
Upgrade affected WNC T-Mobile 5G Box IDU routers to firmware version 1.1.0.651412 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.