CVE-2026-40857

HighCVSS 8.4/10Last modified Sep 28, 2026

Description

WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.This issue has been fixed in firmware version 1.1.0.651412

Metrics

CVSS 4.0 8.4/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-352

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
WNC	T-Mobile 5G Box IDU	< 1.1.0.651412

References

https://cert.pl/posts/2026/09/CVE-2026-40854

Timeline

Published: Sep 16, 2026
Last modified: Sep 28, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-408588.8The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using CVE-2026-408598.1Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying CVE-2026-40866.4The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attribut CVE-2026-408609.8JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS Ob CVE-2026-408616.5A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server pro CVE-2026-408637.5PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the Sprea CVE-2026-408644.3JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protecti CVE-2026-408657.1Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee doc CVE-2026-408668.6Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee doc CVE-2026-408677.1Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk a CVE-2026-408688.1Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper impli CVE-2026-408696.5Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows a