Poland's national cybersecurity agency, CERT Polska operating under the NASK National Research Institute, in coordinated disclosure with hardware manufacturer WNC (Wistron NeWeb Corporation) and mobile network carrier T-Mobile, has issued an urgent vulnerability advisory detailing four critical flaws impacting the WNC T-Mobile 5G Box IDU router family. Deployed across hundreds of thousands of residential and commercial subscribers for fixed-wireless 5G internet connectivity, the vulnerabilities permit unauthenticated network adversaries to harvest sensitive configuration secrets and execute arbitrary code with root privileges on the underlying operating system.
According to CERT Polska's findings, the vulnerabilities stem from fundamental architectural deficiencies within the device's web management Common Gateway Interface (CGI) implementations.
The coordinated disclosure outlines four severe vulnerability vectors: 1. Unauthenticated Credential Disclosure (CVE-2026-40856): The web endpoint `wnc_maccheck.cgi` completely lacks authentication enforcement. Any remote network actor can query this interface to receive the device's complete plaintext configuration data – including the administrative web interface password, Wi-Fi WPA2/WPA3 pre-shared keys, and technical device telemetry. 2. OS Command Injection via Diagnostics (CVE-2026-40855): Within `/cgi-bin/portal.cgi`, the device's network diagnostic ping utility improperly sanitizes user inputs supplied across the `ping_ip`, `ping_size`, and `ping_times` POST parameters. By chaining shell metacharacters, an attacker can escape the ping routine to execute arbitrary system instructions with complete administrative authority (`root`). 3. OS Command Injection in Credential Updates (CVE-2026-58147): The administrative password modification utility within `portal.cgi` similarly fails to neutralize special elements within the `http_passwd_hidden` and `http_passwdConfirm_hidden` parameters, providing a secondary avenue to root shell compromise. 4. Anti-CSRF Mechanism Validation Bypass (CVE-2026-40857): The router's Cross-Site Request Forgery (CSRF) protection fails to validate token hashes, accepting arbitrary arbitrary dummy strings as valid.
Chaining these flaws permits remote adversaries to craft malicious web links that silently compromise the victim's router upon visiting, enabling attackers to hijack DNS resolution, harvest confidential communications, and enlist the equipment into distributed denial-of-service (DDoS) botnets.
Network Remediation and Subscriber Guidance
- Verify Over-the-Air Firmware Update Delivery: T-Mobile and WNC have deployed remediation builds over-the-air. Log into the router management console and confirm firmware numbers align with vendor release notes.
- Rotate Administrative and Wi-Fi Passwords Immediately: In the wake of unauthenticated configuration exposure vectors, subscribers should immediately change Wi-Fi pre-shared keys and web passwords.
- Enforce WAN Administrative Access Termination: Ensure external remote management interfaces remain strictly disabled across public internet boundaries.
Threat Hunting Indicators and Forensic Verification
Network analysts and digital forensic examiners should inspect network telemetry for the following compromise artifacts:
1. Audit HTTP Telemetry for wnc_maccheck.cgi Queries: Inspect access logs for queries directed toward `wnc_maccheck.cgi` originating from suspicious client IP addresses. 2. Validate Gateway DNS Resolver Allocations: Confirm that primary and secondary gateway DNS settings match authorized carrier configurations and have not been hijacked. 3. Audit Unregistered Listening Management Services: Scan router IP interfaces to ensure unauthorized remote shell listeners (e.g., Telnet or SSH daemons) have not been established.