Loading vulnerability…
CSRF in WNC T-Mobile 5G Box IDU Router
CVE-2026-40857 is a cross-site request forgery vulnerability in WNC T-Mobile 5G Box IDU router firmware before version 1.1.0.651412. The router’s anti-CSRF implementation accepts arbitrary token values instead of validating that a request carries a valid token associated with the authenticated session. Consequently, attacker-controlled cross-origin requests can be processed as though they were legitimate requests from an authenticated administrator.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can cause an authenticated router user to perform unauthorized administrative actions by inducing the user to visit an attacker-controlled web page. The precise set of actions available through exploitation depends on the state-changing functions exposed to the authenticated web-management session.
If you can’t patch tonight, do this now.
Until firmware is updated, restrict access to the router management interface to trusted networks and users, and avoid browsing untrusted sites while authenticated to the router’s management interface. End management sessions when administration is complete.
Patch, then assume compromise.
Update WNC T-Mobile 5G Box IDU router firmware to version 1.1.0.651412 or later, which corrects the anti-CSRF token validation flaw.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.