EUVD-2026-80669

ID: EUVD-2026-80669

Severity: high

CVSS v4: 8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v3: Not provided

CWE: None listed

Source: ENISA

Description

WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/login_user. An attacker can bypass authentication by using directory entries such as "." or ".." in the cookie, allowing unauthorized access to the administration panel.This issue has been fixed in firmware version 1.1.0.651412

Timestamps

Normalized: 2026-09-16T19:14:49Z UTC
Last updated: 2026-09-16T19:14:49Z UTC

References

No references provided.

VulnAI

EUVD-2026-80669

Description

Timestamps

References