Loading vulnerability…
Unauthenticated Sensitive Information Disclosure in WNC T-Mobile 5G Box IDU
CVE-2026-40856 is an improper access-control vulnerability in WNC T-Mobile 5G Box IDU router firmware prior to version 1.1.0.651412. An exposed CGI interface does not require authentication before returning sensitive router configuration data. The disclosed data includes the administrator web-interface password, Wi-Fi passphrase, and technical device information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can obtain credentials and configuration information from an affected router. Disclosure of the administrator password can enable subsequent administrative access, while disclosure of the Wi-Fi passphrase can permit unauthorized wireless-network access.
If you can’t patch tonight, do this now.
Until firmware can be updated, restrict management-plane and router web-interface exposure to trusted networks, prohibit Internet access to the device management interface, and rotate the administrator and Wi-Fi credentials after remediation if exposure is suspected.
Patch, then assume compromise.
Upgrade WNC T-Mobile 5G Box IDU routers to firmware version 1.1.0.651412 or a later vendor-provided release that includes the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.