Design/Logic Flaw

2019-01-0923:29:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.3%

JSON

Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user’s web browser. This is a different vulnerability from CVE-2018-0666.

CPENameOperatorVersion
nvr500_firmwareeq<= rev.11.0.36
rt57i_firmwareeq<= rev.8.0.95
rt58i_firmwareeq<= rev.9.1.51
rtx810_firmwareeq<= rev.11.1.31

Name	Operator	Version
nvr500_firmware	eq	<= rev.11.0.36
rt57i_firmware	eq	<= rev.8.0.95
rt58i_firmware	eq	<= rev.9.1.51
rtx810_firmware	eq	<= rev.11.1.31

References

www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN69967692.html

flets-w.com/solution/kiki_info/info/180829.html

jvn.jp/en/jp/JVN69967692/index.html

web116.jp/ced/support/news/contents/2018/20180829b.html