CVE-2026-107153 Details
Description
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.
A vulnerability exists in several smartphone models provided by Rakuten Mobile, Inc., due to the use of AOSP test keys for Android Verified Boot (AVB). This flaw allows an attacker with physical access to the device to install a crafted system image, potentially leading to unauthorized modifications or access. The affected models include the Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten BIGs, all running on various versions.
Users are advised to stop using the affected products, as they are no longer supported. Consider switching to alternative devices.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1391 | Use of Weak Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Rakuten Mobile Rakuten Mini | All versions |
CPE
Remediation
| |
| Rakuten Mobile Rakuten Hand | All versions |
CPE
Remediation
| |
| Rakuten Mobile Rakuten Hand 5G | All versions |
CPE
Remediation
| |
| Rakuten Mobile Rakuten BIGs | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |