CVE-2021-20844
Medium
Description
Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to obtain sensitive information via a specially crafted web page.
SeverityMedium
CVSS5.7
Exploit probability—
ProductYamaha Rtx830 Firmware
PublishedNov 24, 2021
First seenNov 24, 2021
How to fix
Update
- ntt-west biz_box_nvr510_firmware15.01.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yamaha rtx830_firmware | v ≤ 15.02.17 | — |
| yamaha nvr510_firmware | v ≤ 15.01.18 | — |
| yamaha nvr700w_firmware | v ≤ 15.00.19 | — |
| yamaha rtx1210_firmware | v ≤ 14.01.38 | — |
| ntt-west biz_box_rtx830_firmware | v ≤ 15.02.17 | — |
| ntt-west biz_box_nvr510_firmware | v < 15.01.18 | 15.01.18 |
| ntt-west biz_box_nvr700w_firmware | v ≤ 15.00.19 | — |
| ntt-west biz_box_rtx1210_firmware | v ≤ 14.01.38 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.