Vulnerability · Published Oct 14, 2026 · Assigned by jpcert
CVE-2026-107153
Medium 6.6
In plain English
A medium-severity security flaw in Rakuten BIGs from Rakuten Mobile, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.0)6.6Medium
Exploit odds (30 days)0.2%top 90.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rakuten Mobile, Inc. | Rakuten Mini | all versions |
| Rakuten Mobile, Inc. | Rakuten Hand | all versions |
| Rakuten Mobile, Inc. | Rakuten Hand 5G | all versions |
| Rakuten Mobile, Inc. | Rakuten BIGs | all versions |
Weakness: CWE-1391 · Vector: CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://network.mobile.rakuten.co.jp/product/smartphone/rakuten-mini/support/index.html
- https://network.mobile.rakuten.co.jp/product/smartphone/rakuten-hand/support/index.html
- https://network.mobile.rakuten.co.jp/product/smartphone/rakuten-hand-5g/support/index.html
- https://network.mobile.rakuten.co.jp/product/smartphone/rakuten-big-s/support/index.html
- https://jvn.jp/en/jp/JVN47427200/