CVE-2026-408578.4HighCWE-352
CSRF token bypass in T-Mobile 5G Box IDU routers
WNC · T-Mobile 5G Box IDU
Not in CISA KEVVendor fix available
0.2%probability of exploitation in the next 30 days
9th percentile
050100
Higher than 9% of scored CVEs
8.4HighCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.This issue has been fixed in firmware version 1.1.0.651412
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 17 Sep.
- Critical WNC flaws expose T-Mobile 5G Box routers to attacksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.