T-Mobile 5G Box IDU CVE-2026-40854

Exploitation requires network reachability to the router's portal.cgi administration interface - per the AV:A vector this is the adjacent/local network (LAN or Wi-Fi side) rather than the public internet by default. The attacker then simply sets the HTTP sessionid cookie to a directory-entry value such as "." or "..", which always exists under /tmp/login_user, causing the file-existence session check to succeed. No authentication, credentials, user interaction, or non-default configuration is needed on unpatched firmware (versions before 1.1.0.651412). The primary limiting factor is adjacency: an attacker must already be on the same network segment as the device unless remote/WAN management of the admin portal is enabled.

This is a genuine, high-priority flaw for exposed devices. The CVSS 4.0 base score of 8.7 is well-calibrated: the vulnerability is a trivially exploitable authentication bypass (CWE-290) requiring no privileges (PR:N), no user interaction (UI:N), and low attack complexity (AC:L), yielding full compromise of the administration panel (VC:H/VI:H/VA:H). The single meaningful limiter is the Adjacent attack vector (AV:A) - the CVSS vector implies the vulnerable portal.cgi is reachable from the local/adjacent network (LAN/Wi-Fi side of the router) rather than the public internet by default, which is consistent with a customer-premises router administration interface. No EPSS score, CISA KEV entry, or public POC is present in the provided data, so there is no evidence of active exploitation; the risk is driven by the near-zero exploitation effort rather than by observed in-the-wild activity. Note a residual uncertainty: if any deployment exposes the admin portal to the WAN/internet (e.g., remote management enabled), the practical reachability would exceed AV:A - verify management-interface exposure per deployment.

An attacker with access to the router's local network (e.g., a connected Wi-Fi/LAN client or a malicious device on the same segment) sends an HTTP request to portal.cgi with the sessionid cookie set to "." or "..". Because the session check merely tests for the existence of a matching entry under /tmp/login_user - and directory entries "." and ".." always exist - authentication is bypassed and the attacker reaches the full administration panel. No public exploit code is identified in the provided data, but the technique is described in enough detail by CERT-PL to be reproduced trivially.