Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-40856

Config disclosure in T-Mobile 5G Box IDU routers

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERT-PL

Description

WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi passphrase, and technical device information.This issue has been fixed in firmware version 1.1.0.651412

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WNC T-Mobile 5G Box IDU

Default version status: unaffected

  • 0 to < 1.1.0.651412affected

References