CVE-2026-40855

WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root cause is the failure to verify and sanitize user-supplied input before incorporating it into a system command. This allows an authenticated attacker to execute arbitrary commands on the shell and gain root access to the system.This issue has been fixed in firmware version 1.1.0.651412

• CWE-78

• https://cert.pl/posts/2026/09/CVE-2026-40854

Published

Sep 16, 2026

Last Modified

Sep 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40849An low privileged remote attacker can exploit an unauthentic…7.1
• CVE-2026-4085The Easy Social Photos Gallery plugin for WordPress is vulne…6.4
• CVE-2026-40850An unauthenticated remote attacker can exploit an unauthenti…8.7
• CVE-2026-40851A local attacker can perform a confusion attack on the cfgpa…8.4
• CVE-2026-40852A highly authenticated attacker can alter the config generat…7.2
• CVE-2026-40854WNC T-Mobile 5G Box IDU router contains an authentication by…8.7
• CVE-2026-40856WNC T-Mobile 5G Box IDU router is vulnerable to improper acc…7.1
• CVE-2026-40857WNC T-Mobile 5G Box IDU router contains a cross-site request…8.4
• CVE-2026-40858The camel-infinispan component's ProtoStream-based remote ag…8.8
• CVE-2026-40859Deserialization of Untrusted Data vulnerability in Apache Ca…8.1
• CVE-2026-4086The WP Random Button plugin for WordPress is vulnerable to S…6.4
• CVE-2026-40860JmsBinding.extractBodyFromJms() in camel-jms, and the equiva…9.8