CVE-2026-40854

WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/login_user. An attacker can bypass authentication by using directory entries such as "." or ".." in the cookie, allowing unauthorized access to the administration panel.This issue has been fixed in firmware version 1.1.0.651412

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/09/CVE-2026-40854

Configurations

No configuration.

History

28 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El router WNC T-Mobile 5G Box IDU contiene una vulnerabilidad de omisión de autenticación en el componente portal.cgi. El mecanismo de verificación de sesión valida incorrectamente la cookie sessionid al verificar la existencia de un archivo correspondiente en /tmp/login_user. Un atacante puede omitir la autenticación utilizando entradas de directorio como '.' o '..' en la cookie, lo que permite el acceso no autorizado al panel de administración. Este problema ha sido solucionado en la versión de firmware 1.1.0.651412.

16 Sep 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-16 12:17

Updated : 2026-09-28 23:10

NVD link : CVE-2026-40854

Mitre link : CVE-2026-40854

CVE.ORG link : CVE-2026-40854

JSON object : View

Products Affected

No product.

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-40854", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40854", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-16T17:40:01.238581Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "WNC", "product": "T-Mobile 5G Box IDU", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.0.651412", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T12:17:03.540", "references": [{"url": "https://cert.pl/posts/2026/09/CVE-2026-40854", "source": "cvd@cert.pl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/login_user. An attacker can bypass authentication by using directory entries such as \".\" or \"..\" in the cookie, allowing unauthorized access to the administration panel.This issue has been fixed in firmware version\u00a01.1.0.651412"}, {"lang": "es", "value": "El router WNC T-Mobile 5G Box IDU contiene una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en el componente portal.cgi. El mecanismo de verificaci\u00f3n de sesi\u00f3n valida incorrectamente la cookie sessionid al verificar la existencia de un archivo correspondiente en /tmp/login_user. Un atacante puede omitir la autenticaci\u00f3n utilizando entradas de directorio como '.' o '..' en la cookie, lo que permite el acceso no autorizado al panel de administraci\u00f3n. Este problema ha sido solucionado en la versi\u00f3n de firmware 1.1.0.651412."}], "lastModified": "2026-09-28T23:10:00.143", "sourceIdentifier": "cvd@cert.pl"}