PT-2021-14288 · Rtx1210+3 · Rtx1210+3

Shoji Baba · Published 2021-11-24 · Updated 2021-11-30 · CVE-2021-20844

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: RTX830 versions 15.02.17 and earlier NVR510 versions 15.01.18 and earlier NVR700W versions 15.00.19 and earlier RTX1210 versions 14.01.38 and earlier

Description: The issue is related to improper neutralization of HTTP request headers for scripting syntax, allowing a remote authenticated attacker to obtain sensitive information via a specially crafted web page. This affects the Web GUI of the mentioned devices.

Recommendations: For RTX830 versions 15.02.17 and earlier, update to a version later than 15.02.17 to resolve the issue. For NVR510 versions 15.01.18 and earlier, update to a version later than 15.01.18 to resolve the issue. For NVR700W versions 15.00.19 and earlier, update to a version later than 15.00.19 to resolve the issue. For RTX1210 versions 14.01.38 and earlier, update to a version later than 14.01.38 to resolve the issue. As a temporary workaround, consider restricting access to the Web GUI to minimize the risk of exploitation.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2021-20844

Affected Products

Nvr510

Nvr700W

Rtx1210

Rtx830

References · 8

• https://osv.dev/vulnerability/CVE-2021-20844 · Vendor Advisory
• https://business.ntt-east.co.jp/topics/2021/11_09.html · Vendor Advisory
• http://rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.html · Vendor Advisory
• https://ntt-west.co.jp/smb/kiki_info/info/211109.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20844 · Security Note
• https://t.me/cibsecurity/32951 · Telegram Post
• https://jvn.jp/en/vu/JVNVU91161784/index.html · Note
• https://t.me/cvenotify/23970 · Telegram Post