Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0…
Priority LOW 36Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obtain the information stored in the product because the product is set to accept HTTP connections from the WAN side by default.
Why it matters now
EPSS 0.01596 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rakuten Mobile, Inc. | Rakuten Casa | version AP_F_V1_4_1 or AP_F_V2_0_0 | — | No fix listed | CNA |
- Rakuten Casa VendorRakuten Mobile, Inc. Affected version AP_F_V1_4_1 or AP_F_V2_0_0 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rakuten:casa:ap_f_v1_4_1:*:*:*:*:*:*:* | ap_f_v1_4_1 | Vulnerable | Rakuten Mobile, Inc. |
| cpe:2.3:a:rakuten:casa:ap_f_v2_0_0:*:*:*:*:*:*:* | ap_f_v2_0_0 | Vulnerable | Rakuten Mobile, Inc. |
- cpe:2.3:a:rakuten:casa:ap_f_v1_4_1:*:*:*:*:*:*:* Versions ap_f_v1_4_1 Vulnerable ·Rakuten Mobile, Inc.
- cpe:2.3:a:rakuten:casa:ap_f_v2_0_0:*:*:*:*:*:*:* Versions ap_f_v2_0_0 Vulnerable ·Rakuten Mobile, Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-26834
- 2026-10-03 Alias added: GHSA-4w4h-2rm6-37rj
References
More Rakuten Mobile, Inc. Casa vulnerabilities
- TI-2022-11984 Hard-coded credentials in Rakuten Casa CVSS 3.1CRITICAL 9.8
- TI-2022-11346 Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0… CVSS 3.1HIGH 7.2
Sources
- CVE-2022-26834 · CVE Program
- CVE-2022-26834 · NVD
- FIRST EPSS
- GHSA-4w4h-2rm6-37rj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences