CVE-2026-107153
Deferred Deferred - Pending Action

Rakuten Mobile Smartphones AVB Test Key Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: JPCERT/CC

Description
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-107153
EUVD
EUVD-2026-100836

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Rakuten Mobile, Inc. Rakuten Mini all versions
Rakuten Mobile, Inc. Rakuten Hand all versions
Rakuten Mobile, Inc. Rakuten Hand 5G all versions
Rakuten Mobile, Inc. Rakuten BIGs all versions

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1391 The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves multiple Rakuten Mobile smartphones using AOSP test keys for Android Verified Boot (AVB). Attackers with physical access can install a crafted system image, bypassing security checks. The issue stems from weak credentials in AVB, allowing unauthorized firmware installation and potential device compromise.

Detection Guidance

This vulnerability requires physical access to exploit and primarily affects unsupported Rakuten Mobile devices. Detection involves checking device firmware integrity and verifying AVB keys. Use tools like avbtool to inspect boot images for test keys. Inspect device logs for unauthorized firmware flashes or bootloader modifications.

Impact Analysis
  • Attackers may gain temporary control of your device by installing malicious firmware.
  • Unauthorized programs could be executed, leading to data theft or device misuse.
  • Device settings may be altered without your consent, compromising functionality.
  • Since affected devices are no longer supported, no security updates will be provided.
Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to compromised device integrity and data exposure.

Mitigation Strategies
  • Stop using affected devices immediately as they are no longer supported and cannot be patched.
  • Migrate to alternative supported devices to avoid security risks.
  • Ensure no unauthorized physical access to devices is possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107153. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart