EUVD-2026-80671
GHSA-xw9f-4565-4fvc
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated adjacent-network access to an unprotected CGI endpoint (AV:A/AC:L/PR:N/UI:N); confidentiality-only credential disclosure so C:H, I:N, A:N.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
3DescriptionCVE.org
WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi passphrase, and technical device information.This issue has been fixed in firmware version 1.1.0.651412
AnalysisAI
WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without any authentication, letting a device on the same network segment read sensitive configuration data - including the administrator web password and the WiFi passphrase. Exploitation requires network adjacency (CVSS AV:A) such as a rogue or legitimate WiFi client or a wired LAN host; it is not reachable over the internet by default, but no credentials or user interaction are needed once that position is obtained. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network adjacency to the T-Mobile 5G Box IDU router (AV:A) - the attacker must be on the same LAN/WiFi segment, e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but geographically/network-bounded exposure rather than an internet-wide critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor firmware update to version 1.1.0.651412 or later - this is the only complete fix, and it was confirmed by the vendor as available; T-Mobile 5G Box IDU units are usually updated through the carrier's managed firmware channel, so customers should verify the running firmware version in the device administration UI and, if it remains below 1.1.0.651412, request the update through T-Mobile support. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WNC T-Mobile 5G Box IDU routers in use, confirm the deployed firmware version, and flag any unit running firmware below 1.1.0.651412; where the update cannot be applied immediately, isolate affected devices on a dedicated network segment with no access to corporate resources and rotate the administrator web password and WiFi passphrase on those units. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in T Mobile 5G Box Idu
View allUnauthenticated OS command injection in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) lets an attacke
OS command injection in the WNC T-Mobile 5G Box IDU router's portal.cgi password-change function allows an attacker who
Authenticated OS command injection in the WNC T-Mobile 5G Box IDU router's web management portal lets an admin-level att
Authentication bypass in the WNC T-Mobile 5G Box IDU router lets an attacker on the adjacent network reach the portal.cg
Cross-site request forgery in the WNC T-Mobile 5G Box IDU router (portal.cgi) lets a remote attacker drive privileged ac
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today