CVE-2026-40854CWE-290

CVE-2026-40854

published September 16, 2026

CVSS
8.7
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/login_user. An attacker can bypass authentication by using directory entries such as "." or ".." in the cookie, allowing unauthorized access to the administration panel.This issue has been fixed in firmware version 1.1.0.651412

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00319 · 23.6th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-09-16T16:17Z
References (1)
https://cert.pl/posts/2026/09/CVE-2026-40854 · [email protected]
EPSS history
Timeline
  • 18 SEP 03:59Z
    EPSS moved — → 0%
    epss
  • 16 SEP 11:21Z
    Session auth bypass via cookie value in T-Mobile 5G Box IDU routers
    cvelistv5