EUVD-2026-80669
GHSA-7wq2-g42r-wr2h
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Trivial cookie-value auth bypass reachable from the adjacent network (AV:A) with no privileges or interaction, granting full admin control, hence C/I/A:H and S:U.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
3DescriptionCVE.org
WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/login_user. An attacker can bypass authentication by using directory entries such as "." or ".." in the cookie, allowing unauthorized access to the administration panel.This issue has been fixed in firmware version 1.1.0.651412
AnalysisAI
Authentication bypass in the WNC T-Mobile 5G Box IDU router lets an attacker on the adjacent network reach the portal.cgi administration interface and log in without credentials by setting the sessionid cookie to a directory entry such as '.' or '..' that always exists under /tmp/login_user. The flaw affects firmware versions before 1.1.0.651412 and requires no authentication, no user interaction, and no non-default configuration - only network adjacency to the device (LAN or Wi-Fi side), since the assessed vector is AV:A. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the router's portal.cgi administration interface - per the AV:A vector this is the adjacent/local network (LAN or Wi-Fi side) rather than the public internet by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-priority flaw for exposed devices. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released firmware update to version 1.1.0.651412, which CERT-PL confirms fixes the improper session validation in portal.cgi; per the provided data a patch is available from the vendor, so affected owners should upgrade through T-Mobile/WNC's normal firmware distribution channel and verify the installed build string afterward. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WNC T-Mobile 5G Box IDU units in the fleet, confirm their firmware levels, and treat any device running a version below 1.1.0.651412 as exposed; where immediate upgrade is not possible, isolate those devices onto a dedicated network segment with no path to corporate resources, disable remote administration reachable from the LAN/Wi-Fi side, and restrict administrative access to trusted hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in T Mobile 5G Box Idu
View allUnauthenticated OS command injection in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) lets an attacke
OS command injection in the WNC T-Mobile 5G Box IDU router's portal.cgi password-change function allows an attacker who
Authenticated OS command injection in the WNC T-Mobile 5G Box IDU router's web management portal lets an admin-level att
Cross-site request forgery in the WNC T-Mobile 5G Box IDU router (portal.cgi) lets a remote attacker drive privileged ac
WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without an
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today