JVN#64740097
SoftBank Air Terminal 6 vulnerable to OS command injection
Overview
Air Terminal 6 provided by SoftBank Corp. contains an OS command injection vulnerability.
Products Affected
- Air Terminal 6 v1.01.80 and earlier
Description
Air Terminal 6 provided by SoftBank Corp. contains the following vulnerability.
- OS Command Injection (CWE-78)
- CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6
- CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 8.0
- CVE-2026-101107
Impact
Arbitrary commands may be executed with the root privilege by a user who can log in to the web management console of the affected product.
Solution
Update the firmware
According to the developer, the corrected firmware has already been rolled out, and since devices that are not currently connected to the Internet will automatically receive the corrected firmware when they connect, no user action is required.
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Credit
The following persons reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
- Tsuyoshi OHIRA
- socho
- Itsuki Kuriyama of Kyoto Institute of Technology
- Tomoya Ogawa of Toyonaka Municipal Dai-juichi Junior High School
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2026-101107 |
| JVN iPedia |
|