CVE-2024-48895

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote authenticated attacker may execute an arbitrary OS command.

Score

CVSS 3.1 8.8 High

Status

Deferred - vultures@jpcert.or.jp

Published

2024-11-20

Last modified

2024-11-20

Weaknesses

CWE-78

Affected products

• Turbo 5g Firmware (Rakuten)
• Rakuten Turbo 5g (Rakuten Mobile Inc.)

References

• https://jvn.jp/en/vu/JVNVU90667116/
• https://network.mobile.rakuten.co.jp/internet/turbo/information/news/3184/