{"id":"CVE-2026-101107","kind":"vulnerability","aliases":["CVE-2026-101107"],"related":[],"title":"SoftBank Air Terminal 6: OS command injection gives root to console users","description":"An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. Arbitrary commands may be executed with the root privilege by a user who can log in to the web management console of the affected product.","summary":"Air Terminal 6, a SoftBank Corp product, has an OS command injection flaw in its web management console. A user who can log in to that console can run arbitrary commands with root privilege.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Air Terminal 6","fixed":[],"affected":"<= 1.01.80","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["air-terminal-6","firmware","infrastructure","softbank","web-console"],"not_affected_if":["auto-updated","no-console-access","not-air-terminal-6"],"how_to_check":"In the Air Terminal 6 web management console, check the firmware version. v1.01.80 or earlier is affected; a device that has been online since the rollout should already have the corrected firmware. The fixed version number is unknown.","fix":"SoftBank says corrected firmware is already rolled out; devices receive it automatically when connected to the internet, so no user action is needed (per JVN). Fixed version number not published.","status":"open","published_at":"2026-11-12T06:17:10+00:00","first_seen_at":"2026-11-12T06:36:50+00:00","triaged_at":"2026-11-12T06:37:44+00:00","updated_at":"2026-11-12T06:38:34+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-12T06:37:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SoftBank Air Terminal 6: OS command injection gives root to console users","impact":"high","summary":"Air Terminal 6, a SoftBank Corp product, has an OS command injection flaw in its web management console. A user who can log in to that console can run arbitrary commands with root privilege.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["air-terminal-6","softbank","web-console"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated console user runs arbitrary commands as root","analyst_note":"Find affected versions and vendor fix from SoftBank Corp advisory; NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-101107 has no product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"Air Terminal 6","needs_analyst":true,"not_affected_if":["not-air-terminal-6"],"who_is_affected":"Only organisations running Air Terminal 6 with a web management console reachable by users who hold a login. Teams whose devices are not Air Terminal 6 or whose console is not exposed to such users can skip it. Sources do not give affected versions or a fix.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4516,"output_tokens":495,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected versions and vendor fix from SoftBank Corp advisory; NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-101107 has no product ranges.","search":"'-101107':15A,18A '-2026':14A,17A '6':4A,21A,25B,34B,75C 'affect':103C 'air':2A,19A,23B,32B,73C 'air-termin':22B 'arbitrari':61B,80C 'command':6A,42B,62B,68C,81C 'consol':11A,31B,49B,58B,100C 'corp':37B,79C 'cve':13A,16A 'execut':84C 'exist':71C 'firmwar':26B 'flaw':44B 'give':8A 'infrastructur':27B 'inject':7A,43B,69C 'issu':70C 'log':54B,94C 'manag':48B,99C 'may':82C 'os':5A,41B,67C 'privileg':65B,88C 'product':38B,104C 'provid':76C 'root':9A,64B,87C 'run':60B 'softbank':1A,28B,36B,78C 'termin':3A,24B,33B,74C 'terminal':20A 'user':12A,51B,91C 'web':30B,47B,98C 'web-consol':29B","nicknames":[],"mitigations":[],"who_affected":"Air Terminal 6 devices on firmware v1.01.80 or earlier. An attacker needs a login to the web management console, and the CVSS vector is adjacent network (local network), not internet. Devices that have connected to the internet since the rollout are updated automatically, so most users can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Keep your SoftBank Air Terminal 6 connected to the internet so it installs the corrected firmware automatically. SoftBank says no other action is needed.","pkeys":["airterminal6","terminal6"],"ptokens":["air","terminal"],"labels":["airterminal6","firmware","high","infrastructure","softbank","vendor","webconsole"],"campaign_type":null,"search_a":"'-101107':15A,18A '-2026':14A,17A '6':4A,21A 'air':2A,19A 'command':6A 'consol':11A 'cve':13A,16A 'give':8A 'inject':7A 'os':5A 'root':9A 'softbank':1A 'termin':3A 'terminal':20A 'user':12A","search_b":"'6':25B,34B 'air':23B,32B 'air-termin':22B 'arbitrari':61B 'command':42B,62B 'consol':31B,49B,58B 'corp':37B 'firmwar':26B 'flaw':44B 'infrastructur':27B 'inject':43B 'log':54B 'manag':48B 'os':41B 'privileg':65B 'product':38B 'root':64B 'run':60B 'softbank':28B,36B 'termin':24B,33B 'user':51B 'web':30B,47B 'web-consol':29B","search_c":"'6':75C 'affect':103C 'air':73C 'arbitrari':80C 'command':68C,81C 'consol':100C 'corp':79C 'execut':84C 'exist':71C 'inject':69C 'issu':70C 'log':94C 'manag':99C 'may':82C 'os':67C 'privileg':88C 'product':104C 'provid':76C 'root':87C 'softbank':78C 'termin':74C 'user':91C 'web':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101107","severity":null,"published_at":"2026-11-12T06:17:10+00:00","modified_at":"2026-11-12T06:17:10+00:00","first_seen_at":"2026-11-12T06:36:50+00:00","fetched_at":"2026-11-12T06:36:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101107:3711","url":"http://jvn.jp/en/jp/JVN64740097/","severity":null,"published_at":"2026-11-12T06:38:34+00:00","modified_at":"2026-11-12T06:38:34+00:00","first_seen_at":"2026-11-12T06:38:34+00:00","fetched_at":"2026-11-12T06:38:34+00:00","note":"JVN#64740097 (JPCERT/CC coordinated, relays developer statement): v1.01.80 and earlier affected; fixed firmware already rolled out automatically. Fixed version number not published. Not marked verified: JVN is not the vendor's own page.","cites":["http://jvn.jp/en/jp/JVN64740097/"]}],"documents":[{"id":132563,"url":"http://jvn.jp/en/jp/JVN64740097/","title":"JVN#64740097: SoftBank Air Terminal 6 vulnerable to OS command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}