CVE-2026-40857CWE-352csrf

CVE-2026-40857

published September 16, 2026

CVSS
8.4
EPSS
0%
Percentile
8.9
In the wild
Unconfirmed
What it is

WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.This issue has been fixed in firmware version 1.1.0.651412

The record
Technical detail
CVSS
8.4 · NONE
CVSS v4.0
8.4 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00197 · 8.9th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-09-16T16:17Z
References (1)
https://cert.pl/posts/2026/09/CVE-2026-40854 · [email protected]
EPSS history
Timeline
  • 18 SEP 03:59Z
    EPSS moved — → 0%
    epss
  • 16 SEP 11:21Z
    CSRF token bypass in T-Mobile 5G Box IDU routers
    cvelistv5