Rakuten Mobile smartphones use AOSP test keys for Verified Boot
Key facts
- Attack vector
- Physical
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Multiple smartphones provided by Rakuten Mobile, Inc., including Rakuten Mini, Rakuten Hand, Rakuten Hand 5G and Rakuten BIGs, are affected in all versions. These devices use AOSP test keys for Android Verified Boot, a use of weak credentials (CWE-1391). An attacker with physical access to the device can install a crafted system image.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rakuten Mobile, Inc. | Rakuten Mini | all versions | — | No fix listed | CNA |
| Rakuten Mobile, Inc. | Rakuten Hand | all versions | — | No fix listed | CNA |
| Rakuten Mobile, Inc. | Rakuten Hand 5G | all versions | — | No fix listed | CNA |
| Rakuten Mobile, Inc. | Rakuten BIGs | all versions | — | No fix listed | CNA |
- Rakuten Mini VendorRakuten Mobile, Inc. Affected all versions Fixed in — No fix listed CNA
- Rakuten Hand VendorRakuten Mobile, Inc. Affected all versions Fixed in — No fix listed CNA
- Rakuten Hand 5G VendorRakuten Mobile, Inc. Affected all versions Fixed in — No fix listed CNA
- Rakuten BIGs VendorRakuten Mobile, Inc. Affected all versions Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Rakuten Mini, Rakuten Hand, Rakuten Hand 5G or Rakuten BIGs.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-10-14 Threatist record created from CVE-2026-107153
- 2026-10-14 Alias added: GHSA-jwj4-v94m-jmqj
- 2026-10-14 Priority changed: MEDIUM → LOW
- 2026-10-15 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 5
- https://network.mobile.rakuten.co.jp/product/smartphone/rakuten-mini/support/index.html
- https://network.mobile.rakuten.co.jp/product/smartphone/rakuten-hand/support/index.html
- https://network.mobile.rakuten.co.jp/product/smartphone/rakuten-hand-5g/support/index.html
- https://network.mobile.rakuten.co.jp/product/smartphone/rakuten-big-s/support/index.html
- https://jvn.jp/en/jp/JVN47427200/
More Rakuten Mobile, Inc. vulnerabilities
- TI-2025-35211 Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interface CVSS 3.1MEDIUM 6.3
- TI-2019-09383 A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to… CVSS 3.0HIGH 7.8
- TI-2025-12320 Rakuten Viber uses broken or risky cryptographic Algorithm CVSS 3.1CRITICAL 9.8
- TI-2022-11984 Hard-coded credentials in Rakuten Casa CVSS 3.1CRITICAL 9.8
- TI-2024-32592 OS command injection in Rakuten Turbo 5G CVSS 3.1HIGH 8.8
- TI-2019-13537 Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet… CVSS 3.1HIGH 8.8
Sources
- CVE-2026-107153 · CVE Program
- CVE-2026-107153 · NVD
- FIRST EPSS
- GHSA-jwj4-v94m-jmqj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-107153 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences