T-Mobile 5G Box IDU CVE-2026-40856

Exploitation requires network adjacency to the T-Mobile 5G Box IDU router (AV:A) - the attacker must be on the same LAN/WiFi segment, e.g. an authorized-or-rogue WiFi client or a wired LAN host; it is not reachable across the internet by default. Given that position, no authentication, no user interaction, and no special configuration are needed: any adjacent client can request the wnc_maccheck.cgi endpoint on affected firmware (versions below 1.1.0.651412) and receive the admin web password and WiFi passphrase. The primary limiting factor is the adjacent-network requirement; the primary aggravator is that the leaked credentials directly enable full administrative takeover.

This is a genuine but geographically/network-bounded exposure rather than an internet-wide critical. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, base 7.1) tells the real story: exploitation is unauthenticated (PR:N), low-complexity, and requires no user interaction, but AV:A means the attacker must be adjacent - on the same LAN/WiFi segment as the T-Mobile 5G Box, not routing across the internet. Impact is confidentiality-only (VC:H, VI:N/VA:N): the flaw discloses secrets but does not itself modify the device. There is no EPSS score, no CISA KEV entry, and no public exploit code referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. The severity is therefore well-calibrated: CWE-306 (missing authentication) on a config endpoint that leaks the admin web password and WiFi passphrase is high-value, but the AV:A gate keeps it out of remote-mass-exploitation territory. Note a data caveat: the single reference URL points to CVE-2026-40854, not this CVE - the CERT-PL advisory identifier appears mismatched and should be verified against the actual CVE-2026-40856 write-up.

An attacker who gains access to the local network - e.g. by joining the customer's WiFi or plugging into the LAN - sends an unauthenticated HTTP request to the wnc_maccheck.cgi endpoint and receives the router's administrator web password, WiFi passphrase, and device details in the response. Armed with the admin password, the attacker then logs in and takes full control of the router. No public proof-of-concept exploit is referenced in the available data.