CVE-2026-40856 Config disclosure in T-Mobile 5G Box IDU routers
Remote attackers can access unauthenticated endpoints to retrieve sensitive configuration data, including admin passwords and WiFi keys, from T-Mobile 5G Box IDU routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40856?
CVE-2026-40856 is a high-severity missing authorization vulnerability in WNC T-Mobile 5G Box IDU, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi passphrase, and technical device information.This issue has been fixed in firmware version 1.1.0.651412
Weakness: CWE-306
Which versions are affected by CVE-2026-40856?
How do I fix CVE-2026-40856?
No fix has been published for CVE-2026-40856 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-40856 being exploited?
There is no known exploitation of CVE-2026-40856 in the wild and no public exploit code.
Sources
Also known as GHSA-xw9f-4565-4fvc.