Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0…
Priority LOW 37Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log in with the root privilege and perform an arbitrary operation if the product is in its default settings in which is set to accept SSH connections from the WAN side, and is also connected to the Internet with the authentication information unchanged from the default settings.
Why it matters now
EPSS 0.02754 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rakuten Mobile, Inc. | Rakuten Casa | version AP_F_V1_4_1 or AP_F_V2_0_0 | — | No fix listed | CNA |
- Rakuten Casa VendorRakuten Mobile, Inc. Affected version AP_F_V1_4_1 or AP_F_V2_0_0 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rakuten:casa:ap_f_v1_4_1:*:*:*:*:*:*:* | ap_f_v1_4_1 | Vulnerable | Rakuten Mobile, Inc. |
| cpe:2.3:a:rakuten:casa:ap_f_v2_0_0:*:*:*:*:*:*:* | ap_f_v2_0_0 | Vulnerable | Rakuten Mobile, Inc. |
- cpe:2.3:a:rakuten:casa:ap_f_v1_4_1:*:*:*:*:*:*:* Versions ap_f_v1_4_1 Vulnerable ·Rakuten Mobile, Inc.
- cpe:2.3:a:rakuten:casa:ap_f_v2_0_0:*:*:*:*:*:*:* Versions ap_f_v2_0_0 Vulnerable ·Rakuten Mobile, Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-28704
- 2026-10-03 Alias added: GHSA-373m-8w83-9jwp
References
More Rakuten Mobile, Inc. Casa vulnerabilities
- TI-2022-11984 Hard-coded credentials in Rakuten Casa CVSS 3.1CRITICAL 9.8
- TI-2022-10081 Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0… CVSS 3.1HIGH 7.5
Sources
- CVE-2022-28704 · CVE Program
- CVE-2022-28704 · NVD
- FIRST EPSS
- GHSA-373m-8w83-9jwp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences