CVE-2026-40857 in T-Mobile 5G Box IDU
Summary
by MITRE • 09/16/2026
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.This issue has been fixed in firmware version 1.1.0.651412
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The WNC T-Mobile 5G Box IDU router, specifically within its portal.cgi component, suffers from a critical cross-site request forgery vulnerability that undermines the integrity of administrative actions performed through the web interface. This flaw stems directly from an inadequate implementation of anti-CSRF protections, where the system fails to properly validate the csrf_token_value parameter during state-changing requests. Instead of verifying that the token corresponds to a legitimate session initiated by the user or generated securely by the server for each specific action, the application accepts any arbitrary value provided in the request payload as valid. This fundamental design error effectively neutralizes one of the primary defenses against CSRF attacks, leaving authenticated users vulnerable to manipulation by malicious actors who can craft forged requests that appear authentic to the router's backend logic.
From a technical perspective, this vulnerability aligns with CWE-352, which classifies cross-site request forgery as an attack where a user is tricked into submitting a request they did not intend to make. In the context of network infrastructure devices like routers, the impact extends beyond simple data theft or session hijacking. An attacker can exploit this weakness to perform unauthorized administrative actions such as changing DNS settings, modifying firewall rules, disabling security features, or even resetting the device configuration without the knowledge or consent of the legitimate administrator. The attack vector typically involves a remote attacker hosting a malicious webpage that contains hidden forms or JavaScript code designed to send requests to the router's management interface while the victim is logged in and viewing the page. Because the browser automatically includes session cookies with these forged requests, and because the server fails to validate the CSRF token properly, the router processes these commands as if they were legitimate user actions.
The operational impact of this vulnerability is significant for both residential and small business environments relying on T-Mobile 5G internet services. Compromised routers can be used to intercept traffic, redirect users to phishing sites, or serve as part of a larger botnet infrastructure. Furthermore, the ability to alter network configurations without authorization poses a severe risk to data privacy and network stability. Since the vulnerability allows for remote exploitation by any user who visits a malicious site while authenticated, it represents a high-severity threat that requires immediate attention from administrators and end-users alike. The lack of proper token validation means that even if other security measures are in place, such as strong passwords or two-factor authentication, the integrity of administrative sessions remains compromised during active login periods.
To mitigate this risk, users must ensure their device firmware is updated to version 1.1.0.651412 or later, where the developers have addressed the flaw by implementing robust CSRF token validation mechanisms that correctly verify the origin and validity of each request. Until such updates are applied, administrators should avoid logging into the router's management interface on untrusted networks or devices, and consider disabling remote administration features if not strictly necessary. Additionally, employing browser extensions that block third-party cookies can provide an additional layer of defense by preventing some CSRF attack vectors from executing successfully in modern web browsers. From a broader security architecture standpoint, this incident highlights the importance of adhering to OWASP guidelines for session management and ensuring that all state-changing operations are protected with unique, unpredictable tokens tied to specific user sessions rather than static or loosely validated parameters. This case also relates to MITRE ATT&CK technique T1566.002, which describes spearphishing links used to deliver CSRF payloads, emphasizing the need for both technical controls and user awareness in defending against social engineering combined with software vulnerabilities.