EUVD-2026-80672
GHSA-6v9q-56wf-hqwp
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A because the CSRF target is a LAN-side router reached via the victim's browser; UI:R for the required malicious-site visit; PR:N as the attacker needs no credentials but rides the victim's authenticated session.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
3DescriptionCVE.org
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.This issue has been fixed in firmware version 1.1.0.651412
AnalysisAI
Cross-site request forgery in the WNC T-Mobile 5G Box IDU router (portal.cgi) lets a remote attacker drive privileged actions through an already-authenticated administrator's browser, because the anti-CSRF check accepts any value supplied in the csrf_token_value parameter. The flaw affects firmware versions below 1.1.0.651412, is rated 8.4 under CVSS 4.0 (AV:A/PR:N/UI:A, high confidentiality and integrity impact, low availability impact), and requires the victim to be logged into the router portal while being lured to an attacker-controlled page reachable over the adjacent network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a victim who is currently authenticated to the T-Mobile 5G Box IDU portal (portal.cgi), (2) that victim being tricked into visiting an attacker-controlled web page (UI:A), and (3) network adjacency such that the victim's browser can reach the LAN-side router (AV:A). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditionally-exploitable vulnerability rather than an actively-exploited priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the T-Mobile 5G Box IDU to firmware version 1.1.0.651412 or later, which is the vendor-released fix for this CSRF validation failure; confirm the running build in the device portal after flashing and consult the CERT-PL coordination advisory at https://cert.pl/posts/2026/09/CVE-2026-40854 for the authoritative vendor guidance and any related CVE entries in the same advisory set. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WNC T-Mobile 5G Box IDU routers and confirm firmware versions; any device running firmware below 1.1.0.651412 should be flagged for immediate patching, and administrators should be advised to log out of the router portal when not in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in T Mobile 5G Box Idu
View allUnauthenticated OS command injection in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) lets an attacke
OS command injection in the WNC T-Mobile 5G Box IDU router's portal.cgi password-change function allows an attacker who
Authenticated OS command injection in the WNC T-Mobile 5G Box IDU router's web management portal lets an admin-level att
Authentication bypass in the WNC T-Mobile 5G Box IDU router lets an attacker on the adjacent network reach the portal.cg
WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without an
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today