Affected Systems

WNC T-Mobile 5G Box IDU routers running firmware versions before 1.1.0.651412. All six CVEs affect the same product and version range. Vulnerabilities include authentication bypass (CVE-2026-40854), three OS command injection flaws (CVE-2026-40855, CVE-2026-58146, CVE-2026-58147), missing authentication (CVE-2026-40856), and CSRF (CVE-2026-40857).

Exploitation Status

No active exploitation or public PoC reported. Vulnerabilities disclosed via coordinated disclosure through CERT Polska. Technical details published, increasing likelihood of exploit development.

Business Impact

Multiple attack vectors enable full device compromise with root access. CVE-2026-58146 allows unauthenticated remote command execution via the cli_cookie parameter in portal.cgi. CVE-2026-40856 exposes admin credentials and WiFi passphrases without authentication via wnc_maccheck.cgi. CVE-2026-40854 bypasses authentication using directory traversal in session cookies. Authenticated attackers can leverage CVE-2026-40855 and CVE-2026-58147 for command injection. CVE-2026-40857 enables CSRF attacks due to ineffective token validation. Organizations using T-Mobile 5G Box IDU routers face credential theft, network compromise, and potential lateral movement. CVSS scores not published.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade WNC T-Mobile 5G Box IDU routers to firmware version 1.1.0.651412 or later
  • Identify all affected devices using asset inventory; search for WNC or T-Mobile 5G Box IDU models with firmware below 1.1.0.651412
  • Restrict management interface access to trusted networks only; disable remote administration if not required
  • Monitor router logs for suspicious activity targeting /cgi-bin/portal.cgi and wnc_maccheck.cgi endpoints, especially POST requests with unusual parameters (cli_cookie, ping_ip, http_passwd_hidden)
  • Reset admin and WiFi credentials after patching if CVE-2026-40856 exposure is suspected, as passwords may have been exfiltrated

---

# Geopolitical Context

Geopolitical Context

This disclosure represents routine cybersecurity vulnerability coordination by Poland's national CERT, targeting consumer telecommunications infrastructure. The vulnerabilities affect WNC (Wistron NeWeb Corporation) routers deployed by T-Mobile, a major telecommunications provider with significant European market presence. The severity of the flaws—including authentication bypass, OS command injection, and unauthenticated access to credentials—underscores ongoing challenges in securing consumer-grade 5G equipment as telecommunications infrastructure expands. Poland's proactive vulnerability disclosure aligns with broader EU efforts to strengthen critical infrastructure resilience under the NIS2 Directive framework. The involvement of Polish security researchers and CERT Polska's coordinated disclosure process reflects growing technical capacity within Central European cybersecurity institutions. While this appears to be a standard vulnerability research and disclosure case without indicators of active exploitation or state-sponsored activity, the telecommunications sector remains a priority target for both criminal and state-aligned threat actors seeking persistent access to network infrastructure.

State Actor Alignment

No state actor involvement is indicated in this disclosure. CERT Polska's publication follows a coordinated vulnerability disclosure (CVD) process with responsible researchers Patryk Bogdan and Adam Borczyk. The vulnerabilities were reported to CERT Polska, which coordinated with the vendor (WNC) to produce patches before public disclosure—consistent with standard cybersecurity industry practice. There is no evidence suggesting state-sponsored discovery, exploitation, or targeting. The disclosure reflects Poland's alignment with EU and NATO cybersecurity norms emphasizing transparency, vendor coordination, and infrastructure hardening.

Business Impacty pro region

The vulnerabilities affect T-Mobile 5G consumer routers, which may be deployed across T-Mobile's European footprint, including Poland, Germany, Austria, the Netherlands, and other markets where Deutsche Telekom subsidiaries operate. The severity of the flaws—particularly the unauthenticated command injection (CVE-2026-58146) allowing root access—poses risks to residential and small business customers if devices remain unpatched. Given the strategic importance of 5G infrastructure to European digital sovereignty initiatives, vulnerabilities in widely deployed consumer equipment could provide footholds for adversaries seeking access to telecommunications networks. The disclosure may prompt regulatory scrutiny under the EU Cybersecurity Act and NIS2 Directive, particularly regarding vendor security practices and telecom operator due diligence in equipment procurement. Poland's role in the disclosure reinforces its position as an active contributor to European cybersecurity coordination, particularly relevant given its geographic proximity to ongoing regional tensions and its role as a NATO eastern flank state.

Forecast

If T-Mobile and WNC successfully deploy firmware version 1.1.0.651412 across affected device populations, the immediate risk of exploitation is likely to diminish for compliant users. However, consumer IoT and router patching rates historically remain low, suggesting a significant portion of vulnerable devices may remain exposed for months or years. If threat actors—whether criminal or state-aligned—identify and exploit these vulnerabilities before widespread patching occurs, compromised routers could serve as persistent access points for network reconnaissance, traffic interception, or botnet recruitment. Telecommunications regulators in EU member states may increase scrutiny of vendor security practices and operator supply chain risk management, potentially leading to stricter certification requirements for 5G customer premises equipment. If similar vulnerabilities are discovered in other WNC or T-Mobile devices, confidence in vendor security posture may erode, prompting operators to diversify equipment suppliers—a trend consistent with broader European efforts to reduce dependency on single vendors in critical telecommunications infrastructure.