Read the docs
TI-2026-29513 Aliases CVE-2026-40856GHSA-xw9f-4565-4fvc

Config disclosure in T-Mobile 5G Box IDU routers

Priority LOW 31CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi passphrase, and technical device information.This issue has been fixed in firmware version 1.1.0.651412

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00373 31st percentileScored 2026-11-07
Fix Fixed T-Mobile 5G Box IDU (WNC): 1.1.0.651412

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WNCT-Mobile 5G Box IDUbefore 1.1.0.6514121.1.0.651412Patch availableCNA
  • T-Mobile 5G Box IDU VendorWNC Affected before 1.1.0.651412 Fixed in 1.1.0.651412 Patch available CNA

Remediation

  • Fix · CNA T-Mobile 5G Box IDU (WNC) Fixed in 1.1.0.651412

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WNC T-Mobile 5G Box IDU 1.1.0.651412

    6 records Highest priority Priority MEDIUM 4 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-41864 Unauthorized remote code execution in T-Mobile 5G Box IDU routersPriority MEDIUM 48
    • TI-2026-41865 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routersPriority MEDIUM 45
    • TI-2026-29512 Command Injection in T-Mobile 5G Box IDU router via ping functionalityPriority MEDIUM 45
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40856
  2. 2026-10-03 Alias added: GHSA-xw9f-4565-4fvc

References

Other 1

  • TI-2026-41864 Unauthorized remote code execution in T-Mobile 5G Box IDU routers CVSS 4.0CRITICAL 9.4
  • TI-2026-41865 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers CVSS 4.0CRITICAL 9.3
  • TI-2026-29512 Command Injection in T-Mobile 5G Box IDU router via ping functionality CVSS 4.0CRITICAL 9.3
  • TI-2026-29511 Session auth bypass via cookie value in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 8.7
  • TI-2026-29514 CSRF token bypass in T-Mobile 5G Box IDU routers CVSS 4.0HIGH 8.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences