Read the docs
TI-2026-29511 Aliases CVE-2026-40854GHSA-7wq2-g42r-wr2h

Session auth bypass via cookie value in T-Mobile 5G Box IDU routers

Priority MEDIUM 40CWE-290Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/login_user. An attacker can bypass authentication by using directory entries such as "." or ".." in the cookie, allowing unauthorized access to the administration panel.This issue has been fixed in firmware version 1.1.0.651412

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Fix Fixed T-Mobile 5G Box IDU (WNC): 1.1.0.651412

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WNCT-Mobile 5G Box IDUbefore 1.1.0.6514121.1.0.651412Patch availableCNA
  • T-Mobile 5G Box IDU VendorWNC Affected before 1.1.0.651412 Fixed in 1.1.0.651412 Patch available CNA

Remediation

  • Fix · CNA T-Mobile 5G Box IDU (WNC) Fixed in 1.1.0.651412

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WNC T-Mobile 5G Box IDU 1.1.0.651412

    6 records Highest priority Priority MEDIUM 4 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-41864 Unauthorized remote code execution in T-Mobile 5G Box IDU routersPriority MEDIUM 48
    • TI-2026-41865 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routersPriority MEDIUM 45
    • TI-2026-29512 Command Injection in T-Mobile 5G Box IDU router via ping functionalityPriority MEDIUM 45
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40854
  2. 2026-10-03 Alias added: GHSA-7wq2-g42r-wr2h

References

Advisory 1

  • TI-2026-41864 Unauthorized remote code execution in T-Mobile 5G Box IDU routers CVSS 4.0CRITICAL 9.4
  • TI-2026-41865 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers CVSS 4.0CRITICAL 9.3
  • TI-2026-29512 Command Injection in T-Mobile 5G Box IDU router via ping functionality CVSS 4.0CRITICAL 9.3
  • TI-2026-29514 CSRF token bypass in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 8.4
  • TI-2026-29513 Config disclosure in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences