CVE-2026-40856 in T-Mobile 5G Box IDU
Summary
by MITRE • 09/16/2026
WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi passphrase, and technical device information.This issue has been fixed in firmware version 1.1.0.651412
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The WNC T-Mobile 5G Box IDU router contains a critical security flaw within its management interface that stems from improper access control mechanisms. This vulnerability is specifically located in the wnc_maccheck.cgi endpoint, which serves as an administrative function for verifying device MAC addresses or similar network identification tasks. The core issue arises because this specific CGI script does not enforce any form of authentication before executing its logic and returning results to the requester. In a properly secured embedded system, endpoints that handle sensitive configuration data or perform privileged operations must require valid credentials from an authorized administrator session. By failing to implement these basic access controls, the router exposes internal operational details to any entity capable of reaching the device over the network, whether through local area networks or potentially via exposed WAN interfaces if firewall rules are misconfigured.
The exploitation of this vulnerability allows a remote attacker to retrieve highly sensitive configuration data without prior authentication. Specifically, an unauthenticated user can query the wnc_maccheck.cgi endpoint and receive responses containing the administrator web password used for logging into the router's management interface, the WiFi passphrase that secures wireless communications, and various technical device information such as hardware identifiers or network settings. The exposure of the administrative password is particularly severe because it grants full control over the device configuration. An attacker can use this credential to log in via HTTP/HTTPS, modify firewall rules, redirect traffic, disable security features, or install malicious firmware. Similarly, obtaining the WiFi passphrase allows an adversary to join the protected wireless network, potentially leading to further lateral movement within a home or small business network environment where sensitive personal and financial data is transmitted.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, as well as CWE-798, concerning the use of hardcoded credentials if those passwords are static across devices, though in this case, they appear to be dynamically generated but improperly protected during retrieval. In terms of attack vectors and tactics, this flaw facilitates initial access and credential harvesting phases within the MITRE ATT&CK framework. Specifically, it relates to techniques involving unsecured services or misconfigured permissions that allow unauthorized data exfiltration. The ability to retrieve credentials without authentication represents a significant degradation of the security posture, effectively nullifying the intended separation between administrative functions and public-facing endpoints on the device's web server.
The operational impact of this vulnerability extends beyond simple information disclosure. Once an attacker possesses the administrator password and WiFi passphrase, they can compromise the integrity and confidentiality of all devices connected to the network. This includes intercepting unencrypted traffic, performing man-in-the-middle attacks against other IoT devices that may have weak security postures themselves, or using the router as a pivot point for broader network intrusions. For residential users, this could lead to identity theft, financial fraud, and privacy violations. For enterprise environments relying on similar hardware, it poses risks of data breaches and regulatory non-compliance regarding data protection standards such as GDPR or HIPAA if sensitive information traverses the compromised network infrastructure.
To mitigate this risk, immediate action is required by deploying firmware version 1.1.0.651412 or any later release that addresses this specific access control flaw. Network administrators should verify their current firmware versions and apply updates through the official vendor support channels to ensure the wnc_maccheck.cgi endpoint now requires proper authentication before returning sensitive data. In addition to patching, it is advisable to change all default passwords immediately after updating, as previous credentials may have been compromised if the vulnerability was actively exploited in the wild. Furthermore, organizations should review their network segmentation strategies and firewall rules to ensure that management interfaces are not unnecessarily exposed to untrusted networks, thereby adding a layer of defense-in-depth even if similar vulnerabilities exist in other components of the device firmware.