Vulnerability in Nippon Telegraph And Telephone East Corporation Biz Box Router N58i, N500
CVE-2018-0666
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0665.
EPSS: 0.007 (47.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Nippon Telegraph And Telephone East Corporation Biz Box Router N58i, N500 — versions n/a
- Nippon Telegraph And Telephone West Corporation Biz Box Router N58i, N500, Nvr500, Rtx810 — versions n/a
- Yamaha Nvr500
- Yamaha Nvr500_firmware
- Yamaha Rt57i
- Yamaha Rt57i_firmware
- Yamaha Rt58i
- Yamaha Rt58i_firmware
- Yamaha Rtx810
- Yamaha Rtx810_firmware
References
- vultures@jpcert.or.jp (Third Party Advisory, x_refsource_MISC)
- vultures@jpcert.or.jp (Third Party Advisory, x_refsource_JVN, third-party-advisory)
- vultures@jpcert.or.jp (Third Party Advisory, x_refsource_MISC)
- vultures@jpcert.or.jp (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-0666?
- CVE-2018-0666 is a medium-severity vulnerability in Nippon Telegraph And Telephone East Corporation Biz Box Router N58i, N500. CVSS score: 6.8/10. Published 2019-01-09.
- How severe is CVE-2018-0666?
- Medium severity. CVSS v3 base score is 6.8 out of 10.