Which versions of T-Mobile 5G Box IDU are affected by CVE-2026-40855?

The WNC T-Mobile 5G Box IDU router is affected by a critical authenticated command-injection flaw that can give an attacker with administrator credentials on the local network root-level control of…. A patch is available.

How to fix or mitigate CVE-2026-40855?

Within 24 hours, inventory all WNC T-Mobile 5G Box IDU routers and confirm which run firmware below 1.1.0.651412; restrict access to the web management portal to trusted management VLANs or local admin workstations only, disable remote or adjacent portal exposure where not required, and validate that only authorized high-privilege accounts can reach /cgi-bin/portal.cgi. Within 7 days, apply the vendor-released patch, firmware 1.1.0.651412 or later, to every affected device, verify the update through the management interface, and rotate administrator credentials afterward. Within 30 days, re-scan the fleet to confirm no devices remain below 1.1.0.651412, review portal and device logs for unusual ping diagnostic activity, enforce unique least-privilege admin accounts and network segmentation for router management, and add firmware-version compliance checks to ongoing vulnerability management.

T-Mobile 5G Box IDU CVE-2026-40855

Q: What is the CVSS score of CVE-2026-40855?

CVE-2026-40855 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80670 CRITICAL

OS Command Injection (CWE-78)

2026-09-16 CERT-PL

GHSA-5qwp-rxmm-2vwh

Command Injection T Mobile 5G Box Idu

9.3

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.4 HIGH

Adjacent-network web portal (AV:A), authenticated admin access (PR:H), web-app injection escaping to root OS shell (S:C) with full C/I/A compromise.

3.1 AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 12:15 vuln.today

Patch available

Sep 16, 2026 - 12:03 EUVD

CVE Published

Sep 16, 2026 - 11:21 cve.org

CRITICAL 9.3

DescriptionCVE.org

WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root cause is the failure to verify and sanitize user-supplied input before incorporating it into a system command. This allows an authenticated attacker to execute arbitrary commands on the shell and gain root access to the system.This issue has been fixed in firmware version 1.1.0.651412

AnalysisAI

Authenticated OS command injection in the WNC T-Mobile 5G Box IDU router's web management portal lets an admin-level attacker on the adjacent network run arbitrary shell commands as root. The flaw (CWE-78) sits in the ping diagnostic feature of /cgi-bin/portal.cgi, where the ping_ip, ping_size, and ping_times POST parameters are concatenated into a system command without validation or sanitization; no user interaction is required once credentials are held. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires (1) network reachability to the router's web management interface, which is adjacent/local per AV:A rather than internet-facing, and (2) valid authenticated (admin-level, PR:H) access to the device portal. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a CWE-78 OS command injection in the ping diagnostic feature of the WNC T-Mobile 5G Box IDU router's web portal (/cgi-bin/portal.cgi), yielding root code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade the T-Mobile 5G Box IDU to firmware version 1.1.0.651412, which is the vendor-released patch that fixes the command injection in the /cgi-bin/portal.cgi ping handler (patch available from the vendor; see the CERT-PL advisory at https://cert.pl/posts/2026/09/CVE-2026-40854 and the EUVD entry EUVD-2026-80670). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WNC T-Mobile 5G Box IDU routers and confirm which run firmware below 1.1.0.651412; restrict access to the web management portal to trusted management VLANs or local admin workstations only, disable remote or adjacent portal exposure where not required, and validate that only authorized high-privilege accounts can reach /cgi-bin/portal.cgi. …

Threat intelligence, references, and detailed analysis are available after sign-in.