PT-2019-8691 · Yamaha · Nvr500+3

Tomonori Yamamoto · Published 2019-01-09 · Updated 2020-08-24 · CVE-2018-0666

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yamaha routers RT57i versions 8.00.95 and earlier Yamaha routers RT58i versions 9.01.51 and earlier Yamaha routers NVR500 versions 11.00.36 and earlier Yamaha routers RTX810 versions 11.01.31 and earlier

Description The issue allows an administrative user to embed arbitrary scripts into the configuration data through a certain form field of the configuration page. These scripts may be executed on another administrative user's web browser.

Recommendations For RT57i versions 8.00.95 and earlier, update to a version later than 8.00.95 to resolve the issue. For RT58i versions 9.01.51 and earlier, update to a version later than 9.01.51 to resolve the issue. For NVR500 versions 11.00.36 and earlier, update to a version later than 11.00.36 to resolve the issue. For RTX810 versions 11.01.31 and earlier, update to a version later than 11.01.31 to resolve the issue. As a temporary workaround, consider restricting access to the configuration page to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-0666

Affected Products

Nvr500

Rt57I

Rt58I

Rtx810

References · 6

• https://osv.dev/vulnerability/CVE-2018-0666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0666 · Security Note
• http://rtpro.yamaha.co.jp/RT/FAQ/Security/JVN69967692.html · Note
• https://web116.jp/ced/support/news/contents/2018/20180829b.html · Note
• https://flets-w.com/solution/kiki_info/info/180829.html · Note
• https://jvn.jp/en/jp/JVN69967692/index.html · Note