# CVE-2026-40854: WNC T-Mobile 5G Box IDU authentication bypass in portal.cgi

Source: https://junglewise.ai/threats/cve-2026-40854-wnc-t-mobile-5g-box-idu-authentication-bypass-in-portal-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-40854 · Severity: info · CVSS 7.5 · Published 2026-09-16

The WNC T-Mobile 5G Box IDU is a 5G wireless router used by T-Mobile customers to provide home internet service. This vulnerability allows attackers to bypass login authentication by exploiting a flaw in how the router validates user session cookies, potentially granting unauthorized access to the administrative control panel and sensitive network configuration settings.

Technologies: [WNC T-Mobile 5G Box IDU](https://junglewise.ai/threats/technologies/t-mobile-5g-box-idu). Vendors: [WNC](https://junglewise.ai/threats/vendors/wnc).

## Quick answers

**Is CVE-2026-40854 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40854 being exploited in the wild.

**How severe is CVE-2026-40854?** Informational severity, with a CVSS score of 7.5, published 16 September 2026.

**Which products and versions are affected?** WNC T-Mobile 5G Box IDU All versions before 1.1.0.651412.

**Is there a fix for CVE-2026-40854?** A patch was published on 2026-09-16: Fixed in firmware version 1.1.0.651412 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40854 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40854?** Check whether you run WNC T-Mobile 5G Box IDU at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-40854 is an authentication bypass vulnerability in the portal.cgi component of the WNC T-Mobile 5G Box IDU router. The session verification mechanism fails to properly validate the sessionid cookie; it only checks for the existence of a corresponding file in /tmp/login_user, allowing attackers to bypass authentication by injecting directory traversal sequences (e.g., "." or "..") into the cookie value. No authentication is required—the attack is network-accessible. A successful exploit grants an unauthenticated attacker full access to the device's administrative panel and configuration. The vulnerability was fixed in firmware version 1.1.0.651412.

## Affected products

- WNC T-Mobile 5G Box IDU All versions before 1.1.0.651412

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in firmware version 1.1.0.651412

## References

- [https://cert.pl/posts/2026/09/CVE-2026-40854](https://cert.pl/posts/2026/09/CVE-2026-40854)

## Related threats

- [WNC T-Mobile 5G Box IDU OS command injection in password change](https://junglewise.ai/threats/cve-2026-58147-wnc-t-mobile-5g-box-idu-os-command-injection-in-password-change)
- [WNC T-Mobile 5G Box IDU OS command injection in portal.cgi](https://junglewise.ai/threats/cve-2026-58146-wnc-t-mobile-5g-box-idu-os-command-injection-in-portal-cgi)
- [WNC T-Mobile 5G Box IDU CSRF in portal.cgi](https://junglewise.ai/threats/cve-2026-40857-wnc-t-mobile-5g-box-idu-csrf-in-portal-cgi)
- [WNC T-Mobile 5G Box IDU improper access control in wnc_maccheck.cgi](https://junglewise.ai/threats/cve-2026-40856-wnc-t-mobile-5g-box-idu-improper-access-control-in-wnc-maccheck)
- [WNC T-Mobile 5G Box IDU command injection in ping functionality](https://junglewise.ai/threats/cve-2026-40855-wnc-t-mobile-5g-box-idu-command-injection-in-ping-functionality)