JVNVU#90667116
Multiple vulnerabilities in Rakuten Turbo 5G

Overview

Rakuten Turbo 5G provided by Rakuten Mobile, Inc. contains multiple vulnerabilities.

Products Affected

• Rakuten Turbo 5G firmware version V1.3.18 and earlier

Description

Rakuten Turbo 5G provided by Rakuten Mobile, Inc. contains multiple vulnerabilities listed below.

• Missing authentication for critical function (CWE-306)
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Base Score 5.3
  • CVE-2024-47865
• OS command injection (CWE-78)
  • CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 8.8
  • CVE-2024-48895
• Exposure of sensitive system information to an unauthorized control sphere (CWE-497)
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score 5.3
  • CVE-2024-52033

Impact

• An unauthenticated attacker may update or downgrade the firmware on the device (CVE-2024-47865)
• An authenticated attacker may execute an arbitrary OS command (CVE-2024-48895)
• An unauthenticated attacker may obtain information about devices connected through the Wi-Fi (CVE-2024-52033)

Solution

Update the firmware
Update the firmware to the latest version according to the information provided by the developer.