CVE-2026-40856

Config disclosure in T-Mobile 5G Box IDU routers

State: Published
Severity: 7.1 High
Published: Sep 16, 2026
Updated: Sep 16, 2026
Reserved: Apr 15, 2026

Description

WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi passphrase, and technical device information.This issue has been fixed in firmware version 1.1.0.651412

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	CERT-PL

Weaknesses

CWE-306 Missing authentication for critical function

Affected Products

Product	Versions
T-Mobile 5G Box IDUWNC	before 1.1.0.651412Affected

References

https://cert.pl/posts/2026/09/CVE-2026-40854

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.