Published:2026/11/12  Last Updated:2026/11/12

JVN#64740097
SoftBank Air Terminal 6 vulnerable to OS command injection

Overview

Air Terminal 6 provided by SoftBank Corp. contains an OS command injection vulnerability.

Products Affected

  • Air Terminal 6 v1.01.80 and earlier

Description

Air Terminal 6 provided by SoftBank Corp. contains the following vulnerability.

  • OS Command Injection (CWE-78)
    • CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6
    • CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 8.0
    • CVE-2026-101107

Impact

Arbitrary commands may be executed with the root privilege by a user who can log in to the web management console of the affected product.

Solution

Update the firmware
According to the developer, the corrected firmware has already been rolled out, and since devices that are not currently connected to the Internet will automatically receive the corrected firmware when they connect, no user action is required.

Vendor Status

Vendor Status Last Update Vendor Notes
SoftBank Corp. Vulnerable 2026/11/12

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

The following persons reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
- Tsuyoshi OHIRA
- socho
- Itsuki Kuriyama of Kyoto Institute of Technology
- Tomoya Ogawa of Toyonaka Municipal Dai-juichi Junior High School

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-101107
JVN iPedia