AIR TERMINAL 6 · CVE-2026-101107 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Air Terminal 6, a SoftBank Corp product, has an OS command injection flaw in its web management console. A user who can log in to that console can run arbitrary commands with root privilege.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Air Terminal 6 devices on firmware v1.01.80 or earlier. An attacker needs a login to the web management console, and the CVSS vector is adjacent network (local network), not internet. Devices that have connected to the internet since the rollout are updated automatically, so most users can skip it.
Not affected if auto-updated, no-console-access, not-air-terminal-6
Who cares air-terminal-6, firmware, softbank, web-console
v1.01.80 or earlier is affected; a device that has been online since the rollout should already have the corrected firmwareAn OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. Arbitrary commands may be executed with the root privilege by a user who can log in to the web management console of the affected product.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.