The vulnerability stems from Rakuten Mobile smartphones employing AOSP test keys for Android Verified Boot (AVB). An attacker who gains physical access to the device can construct a malicious system image and install it without triggering verification, thereby compromising the device’s integrity and potentially enabling unauthorized control. This weakness is categorized as CWE‑1391.

Affected devices include Rakuten BIGs, Rakuten Hand, Rakuten Hand 5G, and Rakuten Mini smartphones. No specific firmware or version information is disclosed in the advisory.

The CVSS score of 7 indicates a moderate‑to‑high risk. The EPSS score of less than 1 percent suggests a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires physical possession of the device, the threat is limited to scenarios where a phone is lost, stolen, or otherwise in an attacker’s direct custody.