PT-2021-14287 · Rtx1210+3 · Rtx1210+3

Shoji Baba · Published 2021-11-24 · Updated 2021-11-30 · CVE-2021-20843

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: RTX830 versions 15.02.17 and earlier NVR510 versions 15.01.18 and earlier NVR700W versions 15.00.19 and earlier RTX1210 versions 14.01.38 and earlier

Description: The issue is a cross-site script inclusion vulnerability in the Web GUI of the affected products. This allows a remote authenticated attacker to alter the product's settings via a specially crafted web page.

Recommendations: For RTX830 versions 15.02.17 and earlier, update to a version later than 15.02.17 to resolve the issue. For NVR510 versions 15.01.18 and earlier, update to a version later than 15.01.18 to resolve the issue. For NVR700W versions 15.00.19 and earlier, update to a version later than 15.00.19 to resolve the issue. For RTX1210 versions 14.01.38 and earlier, update to a version later than 14.01.38 to resolve the issue. As a temporary workaround, consider restricting access to the Web GUI to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2021-20843

Affected Products

Nvr510

Nvr700W

Rtx1210

Rtx830

References · 8

• https://business.ntt-east.co.jp/topics/2021/11_09.html · Vendor Advisory
• http://rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.html · Vendor Advisory
• https://ntt-west.co.jp/smb/kiki_info/info/211109.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20843 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20843 · Vendor Advisory
• https://t.me/cvenotify/23969 · Telegram Post
• https://t.me/cibsecurity/32945 · Telegram Post
• https://jvn.jp/en/vu/JVNVU91161784/index.html · Note