Vulnerability in Nippon Telegraph And Telephone East Corporation Biz Box Router N58i, N500
CVE-2018-0666
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0665.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (49.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
References
- flets-w.com/solution/kiki_info/info/180829.html (Third Party Advisory)
- jvn.jp/en/jp/JVN69967692/index.html (Third Party Advisory, third-party-advisory)
- web116.jp/ced/support/news/contents/2018/20180829b.html (Third Party Advisory)
- www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN69967692.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2018-0666?
- CVE-2018-0666 is a medium-severity vulnerability in Nippon Telegraph And Telephone East Corporation Biz Box Router N58i, N500. CVSS score: 6.8/10. Published 2019-01-09.
- How severe is CVE-2018-0666?
- Medium severity. CVSS v3 base score is 6.8 out of 10.