The session check on the T-Mobile 5G Box IDU asks one question: is there a file in /tmp/login_user matching the session cookie you sent? Send a cookie containing a single dot, and the answer is yes, because a directory always contains one. That is CVE-2026-40854, and it is the mildest of six flaws CERT Polska disclosed this week in the WNC-built 5G home router.
Two of the six need no login at all.
No password, root shell
CVE-2026-58146 is an operating-system command injection in the same portal.cgi endpoint that carries the broken session check. The value of the cli_cookie POST parameter is concatenated straight into a find command with nothing filtered out of it, which lets a remote attacker who has never authenticated run arbitrary shell commands as root on the device. Beside it, CVE-2026-40856 leaves the wnc_maccheck.cgi endpoint reachable without authentication; asking for it returns configuration data including the administrator web password, the WiFi passphrase and technical details about the device. One bug gives an attacker the box. The other hands over the credentials to keep it.
The rest need a login, and still end at root
CVE-2026-40855 puts the same class of injection in the router's ping feature, where the ping_ip, ping_size and ping_times parameters are passed into a system command unchecked, giving any authenticated user a root shell. CVE-2026-58147 repeats it in the password-change function, through the http_passwd_hidden and http_passwdConfirm_hidden parameters. CVE-2026-40857 is a cross-site request forgery flaw, and a blunt one: the anti-CSRF mechanism reads the csrf_token_value parameter and accepts any value at all, so a logged-in user who visits a hostile page can be made to change the router's settings without ever seeing it happen.
Chained, the shape is obvious. The unauthenticated configuration leak supplies the administrator password, and every authenticated bug above then becomes a remote one.
No severity scores were published
CERT Polska did not assign CVSS scores to any of the six, so there is no severity rating to quote for them, and the advisory does not say how many devices are affected or whether anyone has exploited the flaws. What it does record is the disclosure path: the issues were reported to CERT Polska by Patryk Bogdan and Adam Borczyk, and the team coordinated the fix with the vendor, Wistron NeWeb Corporation.
Update to firmware 1.1.0.651412
Every build before 1.1.0.651412 is affected, and that version carries the fix for all six issues. On a carrier-supplied router the firmware usually arrives by push rather than by the owner's action, so the practical steps are to check the running version in the admin interface, take an update if one is offered, and then change the administrator password and the WiFi passphrase, on the assumption that an unauthenticated reader may already have collected the old ones. Keep the management interface off the public internet.
The full technical detail is in CERT Polska's advisory. It is not the first consumer router this year to give away its own admin password to anybody who asks: we covered a KAON router doing exactly that in August. The same CERT Polska coordination process produced font-parsing flaws in Emacs on Android last month, and more on the country's cyber posture is on our Poland country page.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.