CVE-2026-40857
High
Description
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.This issue has been fixed in firmware version 1.1.0.651412
SeverityHigh
CVSS8.4
Exploit probability—
ProductT-Mobile 5G Box IDU
PublishedSep 16, 2026
First seenSep 16, 2026
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- WNC T-Mobile 5G Box IDU1.1.0.651412 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WNC T-Mobile 5G Box IDU | v < 1.1.0.651412 | 1.1.0.651412 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.