CVE-2024-48895: Rakuten Turbo 5g Firmware

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote authenticated attacker may execute an arbitrary OS command.

Affected products

• Rakuten Turbo 5g Firmware: up to and including 1.3.18
• Rakuten Mobile, Inc Rakuten Turbo 5g: up to and including V1.3.18

Published 2024-11-20. Last modified 2026-06-17.