High severity · published Nov 20, 2024
CVE-2024-48895
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier
8.8
CVSS
1%
EPSS
No
On KEV
Description
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote authenticated attacker may execute an arbitrary OS command.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RT
Rakuten Turbo 5G · Rakuten Mobile, Inc.
V1.3.18 and earlier · source: vendor
T5
Turbo 5g Firmware · Rakuten
through 1.3.18 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-48895
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-48895
jvn.jp
https://jvn.jp/en/vu/JVNVU90667116/
network.mobile.rakuten.co.jp
https://network.mobile.rakuten.co.jp/internet/turbo/information/news/3184/
More from Rakuten Turbo 5G
5.3
CVE-2024-47865
Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier
5.3
CVE-2024-52033
Exposure of sensitive system information to an unauthorized control sphere issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier