T-Mobile 5G Box IDU CVE-2026-40857

Exploitation requires: (1) a victim who is currently authenticated to the T-Mobile 5G Box IDU portal (portal.cgi), (2) that victim being tricked into visiting an attacker-controlled web page (UI:A), and (3) network adjacency such that the victim's browser can reach the LAN-side router (AV:A). The core flaw is that portal.cgi's anti-CSRF mechanism does not validate the csrf_token_value parameter and accepts any arbitrary value, so no valid token needs to be captured. Limiting factors: the required user interaction and the need for an active authenticated session mean this cannot be exploited fully unattended or against an idle/logged-out user, and it only affects firmware below 1.1.0.651412.

This is a genuine but conditionally-exploitable vulnerability rather than an actively-exploited priority. The CVSS 4.0 vector (8.4, AV:A/AC:L/AT:N/PR:N/UI:A) shows an adjacent-network attack vector with low complexity, no attacker authentication, but mandatory user interaction (UI:A) - the attacker cannot act alone, they must lure an already-authenticated router user to a malicious page. Impact is high on confidentiality and integrity (VC:H/VI:H) with low availability impact (VA:L) and no scope change (SC:N/SI:N/SA:N), consistent with a classic CSRF that lets an attacker replay privileged portal actions in the victim's session. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis.' The AV:A choice (adjacent rather than network) reflects that the true target is a LAN-side CPE router reached through the victim's browser; this, combined with the required user interaction and broken-but-present token check, makes real-world exploitation opportunistic and targeted rather than mass-scannable. Note the provided reference URL (cert.pl .../CVE-2026-40854) does not match this CVE ID (CVE-2026-40857), indicating a batched CERT-PL advisory covering sibling issues - the primary advisory should be verified directly.

An attacker crafts a malicious web page containing a forged request to the router's portal.cgi with an arbitrary csrf_token_value (which the flawed check accepts). While logged into the T-Mobile 5G Box IDU admin portal on the same local network, the victim visits the attacker's page, and their browser silently submits privileged configuration changes (e.g., DNS, credentials, or exposure settings). No public exploit code was identified, but the flaw is trivially reproducible given knowledge of the portal's request format.