All the vulnerabilites related to yamaha - fwx120
var-201901-0720
Vulnerability from variot
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0665. The management screen of multiple network devices provided by Yamaha Corporation contains multiple script injection vulnerabilities (CWE-74). The following researchers reported the vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2018-0665 Hayato Doi of Kanazawa Institute of Technology CVE-2018-0666 Tomonori Yamamoto of Mitsui Bussan Secure Directions, Inc.In the case where multiple administrators manage an affected device, an administrator with malicious intent may embed an arbitrary script into the management screen. The embedded script may be executed when another administrator logs into the screen. Yamaha Broadband VoIP Router RT57i and so on are all Yamaha Corporation router products. A security vulnerability exists in the management interface in several Yamaha products
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201901-0720",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvr500",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "rev.11.00.36"
},
{
"model": "rt58i",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "rev.9.01.51"
},
{
"model": "rtx810",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "rev.11.01.31"
},
{
"model": "rt57i",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "rev.8.00.95"
},
{
"model": "fwx120",
"scope": "lte",
"trust": 0.8,
"vendor": "yamaha",
"version": "firewall rev.11.03.25"
},
{
"model": "nvr500",
"scope": "lte",
"trust": 0.8,
"vendor": "yamaha",
"version": "broadband voip router rev.11.00.36"
},
{
"model": "rt57i",
"scope": "lte",
"trust": 0.8,
"vendor": "yamaha",
"version": "broadband voip router rev.8.00.95"
},
{
"model": "rt58i",
"scope": "lte",
"trust": 0.8,
"vendor": "yamaha",
"version": "broadband voip router rev.9.01.51"
},
{
"model": "rtx810",
"scope": "lte",
"trust": 0.8,
"vendor": "yamaha",
"version": "gigabit vpn router rev.11.01.31"
},
{
"model": "firewall fwx120 \u003c=rev.11.03.25",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "broadband voip router rt57i \u003c=rev.8.00.95",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "broadband voip router rt58i \u003c=rev.9.01.51",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "broadband voip router nvr500 \u003c=rev.11.00.36",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "gigabit vpn router rtx810 \u003c=rev.11.01.33",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16849"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0666"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rt57i_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "rev.8.00.95",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rt57i:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rt58i_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "rev.9.01.51",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rt58i:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:nvr500_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "rev.11.00.36",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:nvr500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rtx810_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "rev.11.01.31",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx810:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-0666"
}
]
},
"cve": "CVE-2018-0666",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.2,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.1,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "Single",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 2.7,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2018-000093",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"confidentialityImpact": "NONE",
"exploitabilityScore": 5.1,
"id": "CNVD-2018-16849",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.2,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.1,
"id": "VHN-118868",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 4.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2018-000093",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "High",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-0666",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "IPA",
"id": "JVNDB-2018-000093",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2018-16849",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-341",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-118868",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16849"
},
{
"db": "VULHUB",
"id": "VHN-118868"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0666"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-341"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user\u0027s web browser. This is a different vulnerability from CVE-2018-0665. The management screen of multiple network devices provided by Yamaha Corporation contains multiple script injection vulnerabilities (CWE-74). The following researchers reported the vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2018-0665 Hayato Doi of Kanazawa Institute of Technology CVE-2018-0666 Tomonori Yamamoto of Mitsui Bussan Secure Directions, Inc.In the case where multiple administrators manage an affected device, an administrator with malicious intent may embed an arbitrary script into the management screen. The embedded script may be executed when another administrator logs into the screen. Yamaha Broadband VoIP Router RT57i and so on are all Yamaha Corporation router products. A security vulnerability exists in the management interface in several Yamaha products",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-0666"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "CNVD",
"id": "CNVD-2018-16849"
},
{
"db": "VULHUB",
"id": "VHN-118868"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVN",
"id": "JVN69967692",
"trust": 3.1
},
{
"db": "NVD",
"id": "CVE-2018-0666",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201809-341",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2018-16849",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-118868",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16849"
},
{
"db": "VULHUB",
"id": "VHN-118868"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0666"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-341"
}
]
},
"id": "VAR-201901-0720",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16849"
},
{
"db": "VULHUB",
"id": "VHN-118868"
}
],
"trust": 1.6104166666666666
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16849"
}
]
},
"last_update_date": "2023-12-18T13:08:13.479000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Yamaha Corporation website",
"trust": 0.8,
"url": "http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn69967692.html"
},
{
"title": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION website",
"trust": 0.8,
"url": "https://web116.jp/ced/support/news/contents/2018/20180829b.html"
},
{
"title": "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION website",
"trust": 0.8,
"url": "https://flets-w.com/solution/kiki_info/info/180829.html"
},
{
"title": "Patches for Script Injection Vulnerability (CNVD-2018-16849) for Yamaha Corporation\u0027s Multiple Products",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/138963"
},
{
"title": "Multiple Yamaha Corporation Product security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=84655"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16849"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-341"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-79",
"trust": 0.8
},
{
"problemtype": "CWE-74",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-118868"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0666"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://jvn.jp/en/jp/jvn69967692/index.html"
},
{
"trust": 1.7,
"url": "http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn69967692.html"
},
{
"trust": 1.7,
"url": "https://flets-w.com/solution/kiki_info/info/180829.html"
},
{
"trust": 1.7,
"url": "https://web116.jp/ced/support/news/contents/2018/20180829b.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0665"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0666"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-0665"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-0666"
},
{
"trust": 0.6,
"url": "https://jvn.jp/en/jp/jvn69967692/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16849"
},
{
"db": "VULHUB",
"id": "VHN-118868"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0666"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-341"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2018-16849"
},
{
"db": "VULHUB",
"id": "VHN-118868"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0666"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-341"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-08-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-16849"
},
{
"date": "2019-01-09T00:00:00",
"db": "VULHUB",
"id": "VHN-118868"
},
{
"date": "2018-08-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"date": "2019-01-09T23:29:01.467000",
"db": "NVD",
"id": "CVE-2018-0666"
},
{
"date": "2018-09-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-341"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-08-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-16849"
},
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-118868"
},
{
"date": "2019-08-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"date": "2020-08-24T17:37:01.140000",
"db": "NVD",
"id": "CVE-2018-0666"
},
{
"date": "2020-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-341"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-341"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple script injection vulnerabilities in multiple Yamaha network devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-341"
}
],
"trust": 0.6
}
}
var-201401-0488
Vulnerability from variot
The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149. Yamaha routers is a router device. Multiple Yamaha products are prone to a remote security-bypass vulnerability due to an error in the OSPF protocol specification. Exploiting this issue could allow an attacker to bypass certain security restrictions and take full control of the OSPF AS domain routing table, blackholed traffic, and intercepted traffic. This may aid in further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201401-0488",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "rt250i",
"scope": "eq",
"trust": 1.6,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx3000",
"scope": "eq",
"trust": 1.6,
"vendor": "yamaha",
"version": null
},
{
"model": "fwx120",
"scope": "eq",
"trust": 1.6,
"vendor": "yamaha",
"version": null
},
{
"model": "rt300i",
"scope": "eq",
"trust": 1.6,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx1200",
"scope": "eq",
"trust": 1.6,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx1500",
"scope": "eq",
"trust": 1.6,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx1100",
"scope": "eq",
"trust": 1.6,
"vendor": "yamaha",
"version": null
},
{
"model": "srt100",
"scope": "eq",
"trust": 1.6,
"vendor": "yamaha",
"version": null
},
{
"model": "rt107e",
"scope": "eq",
"trust": 1.6,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx810",
"scope": "eq",
"trust": 1.6,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx810",
"scope": null,
"trust": 1.4,
"vendor": "yamaha",
"version": null
},
{
"model": "fwx120",
"scope": null,
"trust": 1.4,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx1000",
"scope": "eq",
"trust": 1.0,
"vendor": "yamaha",
"version": null
},
{
"model": "rt140",
"scope": "eq",
"trust": 1.0,
"vendor": "yamaha",
"version": null
},
{
"model": "rt105",
"scope": "eq",
"trust": 1.0,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx2000",
"scope": "eq",
"trust": 1.0,
"vendor": "yamaha",
"version": null
},
{
"model": "rt105 series",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rt107e",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rt140 series",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rt250i",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rt300i",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx1000",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx1100",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx1200",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx1500",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx2000",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx3000",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "srt100",
"scope": null,
"trust": 0.8,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx3000/rtx2000/rtx1500/rtx1200/rtx1100/rtx1000",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "rt250i/rt300i/rt107e/rt105/rt140",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "vyatta vrouter software",
"scope": "eq",
"trust": 0.3,
"vendor": "brocade",
"version": "6.6"
},
{
"model": "vyatta vrouter",
"scope": "eq",
"trust": 0.3,
"vendor": "brocade",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00596"
},
{
"db": "BID",
"id": "65163"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005905"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-493"
},
{
"db": "NVD",
"id": "CVE-2013-7310"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rt105:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rt140:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rt250i:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:fwx120:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:srt100:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rt300i:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx1200:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx1100:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx1000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx3000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx810:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx1500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rt107e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx2000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-7310"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dr. Gabi Nakibly from Rafael Advanced Defense Systems as joint work he conducted with Eitan Menahem, Yuval Elovici and Ariel Waizel of Telekom Innovation Laboratories at Ben Gurion University",
"sources": [
{
"db": "BID",
"id": "65163"
}
],
"trust": 0.3
},
"cve": "CVE-2013-7310",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.4,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2013-7310",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CNVD-2014-00596",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-67312",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-7310",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2014-00596",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201401-493",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-67312",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00596"
},
{
"db": "VULHUB",
"id": "VHN-67312"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005905"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-493"
},
{
"db": "NVD",
"id": "CVE-2013-7310"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149. Yamaha routers is a router device. Multiple Yamaha products are prone to a remote security-bypass vulnerability due to an error in the OSPF protocol specification. \nExploiting this issue could allow an attacker to bypass certain security restrictions and take full control of the OSPF AS domain routing table, blackholed traffic, and intercepted traffic. This may aid in further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-7310"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005905"
},
{
"db": "CNVD",
"id": "CNVD-2014-00596"
},
{
"db": "BID",
"id": "65163"
},
{
"db": "VULHUB",
"id": "VHN-67312"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#229804",
"trust": 3.4
},
{
"db": "NVD",
"id": "CVE-2013-7310",
"trust": 3.4
},
{
"db": "JVN",
"id": "JVNVU96465452",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005905",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201401-493",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2014-00596",
"trust": 0.6
},
{
"db": "CERT/CC",
"id": "HTTP://WWW.KB.CERT.ORG/VULS/ID/CKIG-9AAHPZ",
"trust": 0.6
},
{
"db": "BID",
"id": "65163",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-67312",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00596"
},
{
"db": "VULHUB",
"id": "VHN-67312"
},
{
"db": "BID",
"id": "65163"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005905"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-493"
},
{
"db": "NVD",
"id": "CVE-2013-7310"
}
]
},
"id": "VAR-201401-0488",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00596"
},
{
"db": "VULHUB",
"id": "VHN-67312"
}
],
"trust": 1.4313889
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00596"
}
]
},
"last_update_date": "2024-04-19T22:49:59.162000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "FC\u306e\u8a18\u8ff0\u306e\u4e0d\u6574\u5408\u3092\u8d77\u56e0\u3068\u3059\u308bOSPFv2\u306e\u8106\u5f31\u6027(VU#229804)\u306b\u3064\u3044\u3066",
"trust": 0.8,
"url": "http://www.rtpro.yamaha.co.jp/rt/faq/security/vu96465452.html"
},
{
"title": "Yamaha\u0027s various routers OSPF routing protocol implementation design vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/43154"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00596"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005905"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-005905"
},
{
"db": "NVD",
"id": "CVE-2013-7310"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://www.kb.cert.org/vuls/id/ckig-9aahpz"
},
{
"trust": 3.1,
"url": "http://www.kb.cert.org/vuls/id/229804"
},
{
"trust": 2.3,
"url": "http://www.rtpro.yamaha.co.jp/rt/faq/security/vu96465452.html"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-7310"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-7310"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu96465452/"
},
{
"trust": 0.3,
"url": "http://jp.yamaha.com/"
},
{
"trust": 0.3,
"url": "http://www.kb.cert.org/vuls/id/bluu-98ms25"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00596"
},
{
"db": "VULHUB",
"id": "VHN-67312"
},
{
"db": "BID",
"id": "65163"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005905"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-493"
},
{
"db": "NVD",
"id": "CVE-2013-7310"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-00596"
},
{
"db": "VULHUB",
"id": "VHN-67312"
},
{
"db": "BID",
"id": "65163"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005905"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-493"
},
{
"db": "NVD",
"id": "CVE-2013-7310"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-01-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-00596"
},
{
"date": "2014-01-23T00:00:00",
"db": "VULHUB",
"id": "VHN-67312"
},
{
"date": "2014-01-23T00:00:00",
"db": "BID",
"id": "65163"
},
{
"date": "2014-01-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-005905"
},
{
"date": "2014-01-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-493"
},
{
"date": "2014-01-23T17:55:05.277000",
"db": "NVD",
"id": "CVE-2013-7310"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-01-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-00596"
},
{
"date": "2014-01-23T00:00:00",
"db": "VULHUB",
"id": "VHN-67312"
},
{
"date": "2014-01-23T00:00:00",
"db": "BID",
"id": "65163"
},
{
"date": "2014-01-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-005905"
},
{
"date": "2014-01-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-493"
},
{
"date": "2014-01-23T19:39:24.870000",
"db": "NVD",
"id": "CVE-2013-7310"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-493"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yamaha Router OSPF Denial of service in implementation (DoS) Vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-005905"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-493"
}
],
"trust": 0.6
}
}
var-201510-0774
Vulnerability from variot
Multiple router products contain an issue in the protection against clickjacking attacks. Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, unintended operations may be conducted. Multiple Routers are prone to a clickjacking vulnerability because it fails to perform validity checks on certain user actions through HTTP requests. Successful exploits will allow an attacker to compromise the affected device or obtain sensitive information. Other attacks are also possible
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201510-0774",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple venders",
"version": null
},
{
"model": "srt100",
"scope": "eq",
"trust": 0.3,
"vendor": "yamaha",
"version": "0"
},
{
"model": "rtx810",
"scope": "eq",
"trust": 0.3,
"vendor": "yamaha",
"version": "11.1.21"
},
{
"model": "rtx1500",
"scope": null,
"trust": 0.3,
"vendor": "yamaha",
"version": null
},
{
"model": "rtx1210",
"scope": "eq",
"trust": 0.3,
"vendor": "yamaha",
"version": "0"
},
{
"model": "rtx1200",
"scope": "eq",
"trust": 0.3,
"vendor": "yamaha",
"version": "10.1.59"
},
{
"model": "rtv01",
"scope": "eq",
"trust": 0.3,
"vendor": "yamaha",
"version": "0"
},
{
"model": "rt58i",
"scope": "eq",
"trust": 0.3,
"vendor": "yamaha",
"version": "0"
},
{
"model": "rt107e",
"scope": "eq",
"trust": 0.3,
"vendor": "yamaha",
"version": "0"
},
{
"model": "nvr500",
"scope": "eq",
"trust": 0.3,
"vendor": "yamaha",
"version": "11.0.25"
},
{
"model": "fwx120",
"scope": "eq",
"trust": 0.3,
"vendor": "yamaha",
"version": "11.3.8"
},
{
"model": "infocage",
"scope": "eq",
"trust": 0.3,
"vendor": "nec",
"version": "3.1"
},
{
"model": "rtx810",
"scope": "ne",
"trust": 0.3,
"vendor": "yamaha",
"version": "11.1.25"
},
{
"model": "rtx1200",
"scope": "ne",
"trust": 0.3,
"vendor": "yamaha",
"version": "10.1.65"
},
{
"model": "nvr500",
"scope": "ne",
"trust": 0.3,
"vendor": "yamaha",
"version": "11.0.28"
},
{
"model": "fwx120",
"scope": "ne",
"trust": 0.3,
"vendor": "yamaha",
"version": "11.3.13"
},
{
"model": "infocage",
"scope": "ne",
"trust": 0.3,
"vendor": "nec",
"version": "5.1"
}
],
"sources": [
{
"db": "BID",
"id": "77386"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:misc:multiple_vendors",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Noriaki Iwasaki of Cyber Defense Institute",
"sources": [
{
"db": "BID",
"id": "77386"
}
],
"trust": 0.3
},
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 2.6,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2015-000172",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "IPA",
"id": "JVNDB-2015-000172",
"trust": 0.8,
"value": "Low"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple router products contain an issue in the protection against clickjacking attacks. Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, unintended operations may be conducted. Multiple Routers are prone to a clickjacking vulnerability because it fails to perform validity checks on certain user actions through HTTP requests. \nSuccessful exploits will allow an attacker to compromise the affected device or obtain sensitive information. Other attacks are also possible",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-000172"
},
{
"db": "BID",
"id": "77386"
}
],
"trust": 0.99
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVN",
"id": "JVN48135658",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000172",
"trust": 0.8
},
{
"db": "BID",
"id": "77386",
"trust": 0.3
}
],
"sources": [
{
"db": "BID",
"id": "77386"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
]
},
"id": "VAR-201510-0774",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.4625
},
"last_update_date": "2022-05-17T02:02:28.205000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Yamaha Corporation website",
"trust": 0.8,
"url": "http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn48135658.html"
},
{
"title": "vulnera_20151127",
"trust": 0.8,
"url": "http://www.furukawa.co.jp/fitelnet/topic/vulnera_20151127.html"
},
{
"title": "Information from Allied Telesis",
"trust": 0.8,
"url": "https://jvn.jp/jp/jvn48135658/522154/index.html"
},
{
"title": "NV15-019",
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv15-019.html"
},
{
"title": " PLANEX COMMUNICATIONS INC. website ",
"trust": 0.8,
"url": "http://www.planex.co.jp/news/info/20151030_info.shtml"
},
{
"title": "I-O DATA DEVICE, INC. website",
"trust": 0.8,
"url": "http://www.iodata.jp/support/information/2016/clickjacking/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.1,
"url": "http://jvn.jp/en/jp/jvn48135658/index.html"
},
{
"trust": 0.3,
"url": "http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn48135658.html"
},
{
"trust": 0.3,
"url": "http://jpn.nec.com/security-info/secinfo/nv15-019.html"
}
],
"sources": [
{
"db": "BID",
"id": "77386"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "77386"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-30T00:00:00",
"db": "BID",
"id": "77386"
},
{
"date": "2015-10-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-30T00:00:00",
"db": "BID",
"id": "77386"
},
{
"date": "2016-02-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "77386"
}
],
"trust": 0.3
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple routers contain issue in preventing clickjacking attacks",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-000172"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "77386"
}
],
"trust": 0.3
}
}
var-202004-1827
Vulnerability from variot
Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210 firmware Rev.14.01.33 and earlier, RTX3500 firmware Rev.14.00.26 and earlier, and RTX5000 firmware Rev.14.00.26 and earlier), Yamaha Broadband VoIP Router(NVR500 firmware Rev.11.00.38 and earlier), and Yamaha Firewall(FWX120 firmware Rev.11.03.27 and earlier) allow remote attackers to cause a denial of service via unspecified vectors. For multiple network devices provided by Yamaha Corporation, service operation interruption due to processing of received packets (DoS) (CWE-400) Vulnerability exists. This vulnerability information is based on the Information Security Early Warning Partnership. IPA Report to JPCERT/CC Coordinated with the developer. Reporter : Keio University Faculty of Science and Engineering Department of Computer Science Amano Lab Niwa Naoya MrService operation obstruction by a remote third party (DoS) You may be attacked. Yamaha NVR500 and others are products of Yamaha Corporation of Japan. Yamaha NVR500 is an enterprise router. Yamaha RTX810 is a Gigabit VPN (Virtual Private Network) router. Yamaha FWX120 is a firewall product.
Denial of service vulnerabilities exist in many Yamaha products. A remote attacker can use this vulnerability to cause a denial of service
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202004-1827",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "fwx120",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "11.03.27"
},
{
"model": "rtx810",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "11.01.33"
},
{
"model": "rtx1200",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "10.01.76"
},
{
"model": "rtx830",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "15.02.09"
},
{
"model": "nvr500",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "11.00.38"
},
{
"model": "rtx1210",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "14.01.33"
},
{
"model": "rtx3500",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "14.00.26"
},
{
"model": "nvr510",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "15.01.14"
},
{
"model": "rtx5000",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "14.00.26"
},
{
"model": "nvr700w",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "15.00.15"
},
{
"model": "fwx120",
"scope": "eq",
"trust": 0.8,
"vendor": "yamaha",
"version": "\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 rev.11.03.27"
},
{
"model": "nvr500",
"scope": "eq",
"trust": 0.8,
"vendor": "yamaha",
"version": "\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 rev.11.00.38"
},
{
"model": "nvr510",
"scope": "eq",
"trust": 0.8,
"vendor": "yamaha",
"version": "\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 rev.15.01.14"
},
{
"model": "nvr700w",
"scope": "eq",
"trust": 0.8,
"vendor": "yamaha",
"version": "\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 rev.15.00.15"
},
{
"model": "rtx1200",
"scope": "eq",
"trust": 0.8,
"vendor": "yamaha",
"version": "\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 rev.10.01.76"
},
{
"model": "rtx1210",
"scope": "eq",
"trust": 0.8,
"vendor": "yamaha",
"version": "\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 rev.14.01.33"
},
{
"model": "rtx3500",
"scope": "eq",
"trust": 0.8,
"vendor": "yamaha",
"version": "\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 rev.14.00.26"
},
{
"model": "rtx5000",
"scope": "eq",
"trust": 0.8,
"vendor": "yamaha",
"version": "\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 rev.14.00.26"
},
{
"model": "rtx810",
"scope": "eq",
"trust": 0.8,
"vendor": "yamaha",
"version": "\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 rev.11.01.33"
},
{
"model": "rtx830",
"scope": "eq",
"trust": 0.8,
"vendor": "yamaha",
"version": "\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 rev.15.02.09"
},
{
"model": "lte voip router nvr700w \u003c=rev.15.00.15",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "gigabit voip router nvr510 \u003c=rev.15.01.14",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "gigabit vpn router rtx810 \u003c=rev.11.01.33",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "gigabit vpn router rtx830 \u003c=rev.15.02.09",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "gigabit vpn router rtx1200 \u003c=rev.10.01.76",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "gigabit voip router rtx1210 \u003c=rev.14.01.33",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "gigabit voip router rtx3500 \u003c=rev.14.00.26",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "gigabit voip router rtx5000 \u003c=rev.14.00.26",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "broadband voip router nvr500 \u003c=rev.11.00.38",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "firewall fwx120 \u003c=rev.11.03.27",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-21477"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-000021"
},
{
"db": "NVD",
"id": "CVE-2020-5548"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rtx830_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "15.02.09",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx830:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:nvr510_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "15.01.14",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:nvr510:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:nvr700w_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "15.00.15",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:nvr700w:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rtx1210_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "14.01.33",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx1210:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rtx5000_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "14.00.26",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx5000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rtx3500_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "14.00.26",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx3500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:fwx120_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.03.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:fwx120:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rtx810_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.01.33",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx810:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:nvr500_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.00.38",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:nvr500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rtx1200_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.01.76",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx1200:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-5548"
}
]
},
"cve": "CVE-2020-5548",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 7.1,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-000021",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2020-21477",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "High",
"baseScore": 5.9,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-000021",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-5548",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2020-000021",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2020-21477",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202003-1751",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-21477"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-000021"
},
{
"db": "NVD",
"id": "CVE-2020-5548"
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1751"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210 firmware Rev.14.01.33 and earlier, RTX3500 firmware Rev.14.00.26 and earlier, and RTX5000 firmware Rev.14.00.26 and earlier), Yamaha Broadband VoIP Router(NVR500 firmware Rev.11.00.38 and earlier), and Yamaha Firewall(FWX120 firmware Rev.11.03.27 and earlier) allow remote attackers to cause a denial of service via unspecified vectors. For multiple network devices provided by Yamaha Corporation, service operation interruption due to processing of received packets (DoS) (CWE-400) Vulnerability exists. This vulnerability information is based on the Information Security Early Warning Partnership. IPA Report to JPCERT/CC Coordinated with the developer. Reporter : Keio University Faculty of Science and Engineering Department of Computer Science Amano Lab Niwa Naoya MrService operation obstruction by a remote third party (DoS) You may be attacked. Yamaha NVR500 and others are products of Yamaha Corporation of Japan. Yamaha NVR500 is an enterprise router. Yamaha RTX810 is a Gigabit VPN (Virtual Private Network) router. Yamaha FWX120 is a firewall product. \n\r\n\r\nDenial of service vulnerabilities exist in many Yamaha products. A remote attacker can use this vulnerability to cause a denial of service",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-5548"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-000021"
},
{
"db": "CNVD",
"id": "CNVD-2020-21477"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVN",
"id": "JVN38732359",
"trust": 3.0
},
{
"db": "NVD",
"id": "CVE-2020-5548",
"trust": 3.0
},
{
"db": "JVNDB",
"id": "JVNDB-2020-000021",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2020-21477",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1751",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-21477"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-000021"
},
{
"db": "NVD",
"id": "CVE-2020-5548"
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1751"
}
]
},
"id": "VAR-202004-1827",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-21477"
}
],
"trust": 1.5511363636363638
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-21477"
}
]
},
"last_update_date": "2023-12-18T12:56:03.439000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u300c\u30e4\u30de\u30cf\u88fd\u306e\u8907\u6570\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u6a5f\u5668\u306b\u304a\u3051\u308b\u30b5\u30fc\u30d3\u30b9\u904b\u7528\u59a8\u5bb3 (DoS) \u306e\u8106\u5f31\u6027\u300d\u306b\u3064\u3044\u3066 ",
"trust": 0.8,
"url": "http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn38732359.html"
},
{
"title": "Biz Box\u30eb\u30fc\u30bf\u3092\u3054\u5229\u7528\u306e\u304a\u5ba2\u3055\u307e\u3078",
"trust": 0.8,
"url": "https://flets-w.com/solution/kiki_info/info/200331.html"
},
{
"title": "BizBox\u30eb\u30fc\u30bf\u30fb\u30e4\u30de\u30cf\u30eb\u30fc\u30bf\u3092\u3054\u5229\u7528\u306e\u304a\u5ba2\u3055\u307e\u3078",
"trust": 0.8,
"url": "https://web116.jp/ced/support/news/contents/2020/20200331.html"
},
{
"title": "Patch for Multiple Yamaha product denial of service vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/212643"
},
{
"title": "Multiple Yamaha Product security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=115376"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-21477"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-000021"
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1751"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-000021"
},
{
"db": "NVD",
"id": "CVE-2020-5548"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn38732359.html"
},
{
"trust": 1.6,
"url": "https://jvn.jp/en/jp/jvn38732359/index.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-5548"
},
{
"trust": 0.8,
"url": "https://jvn.jp/jp/jvn38732359/index.html"
},
{
"trust": 0.6,
"url": "https://jvn.jp/en/jp/jvn38732359/"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-5548"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-21477"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-000021"
},
{
"db": "NVD",
"id": "CVE-2020-5548"
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1751"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-21477"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-000021"
},
{
"db": "NVD",
"id": "CVE-2020-5548"
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1751"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-04-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-21477"
},
{
"date": "2020-03-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-000021"
},
{
"date": "2020-04-01T12:15:15.210000",
"db": "NVD",
"id": "CVE-2020-5548"
},
{
"date": "2020-03-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202003-1751"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-04-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-21477"
},
{
"date": "2020-04-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-000021"
},
{
"date": "2020-04-02T17:25:32.917000",
"db": "NVD",
"id": "CVE-2020-5548"
},
{
"date": "2020-05-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202003-1751"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202003-1751"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Interfering with service operations on multiple Yamaha network devices (DoS) Vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-000021"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202003-1751"
}
],
"trust": 0.6
}
}
var-201901-0719
Vulnerability from variot
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0666. The management screen of multiple network devices provided by Yamaha Corporation contains multiple script injection vulnerabilities (CWE-74). The following researchers reported the vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2018-0665 Hayato Doi of Kanazawa Institute of Technology CVE-2018-0666 Tomonori Yamamoto of Mitsui Bussan Secure Directions, Inc.In the case where multiple administrators manage an affected device, an administrator with malicious intent may embed an arbitrary script into the management screen. The embedded script may be executed when another administrator logs into the screen. YamahaBroadband VoIPRouterRT57i and so on are all Yamaha Corporation router products. NVR500 Broadband VoIP Router is a router. A security vulnerability exists in the management interface in several Yamaha products. The following products and versions are affected: Yamaha Corporation FWX120 Firewall Rev.11.03.25 and earlier; NVR500 Broadband VoIP Router Rev.11.00.36 and earlier; RT57i Broadband VoIP Router Rev.8.00.95 and earlier; RT58i Broadband VoIP Router Rev.9.01.51 and earlier versions; RTX810 Gigabit VPN Router Rev.11.01.33 and earlier versions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201901-0719",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvr500",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "rev.11.00.36"
},
{
"model": "rt58i",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "rev.9.01.51"
},
{
"model": "rtx810",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "rev.11.01.31"
},
{
"model": "rt57i",
"scope": "lte",
"trust": 1.0,
"vendor": "yamaha",
"version": "rev.8.00.95"
},
{
"model": "fwx120",
"scope": "lte",
"trust": 0.8,
"vendor": "yamaha",
"version": "firewall rev.11.03.25"
},
{
"model": "nvr500",
"scope": "lte",
"trust": 0.8,
"vendor": "yamaha",
"version": "broadband voip router rev.11.00.36"
},
{
"model": "rt57i",
"scope": "lte",
"trust": 0.8,
"vendor": "yamaha",
"version": "broadband voip router rev.8.00.95"
},
{
"model": "rt58i",
"scope": "lte",
"trust": 0.8,
"vendor": "yamaha",
"version": "broadband voip router rev.9.01.51"
},
{
"model": "rtx810",
"scope": "lte",
"trust": 0.8,
"vendor": "yamaha",
"version": "gigabit vpn router rev.11.01.31"
},
{
"model": "firewall fwx120 \u003c=rev.11.03.25",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "broadband voip router rt57i \u003c=rev.8.00.95",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "broadband voip router rt58i \u003c=rev.9.01.51",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "broadband voip router nvr500 \u003c=rev.11.00.36",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
},
{
"model": "gigabit vpn router rtx810 \u003c=rev.11.01.33",
"scope": null,
"trust": 0.6,
"vendor": "yamaha",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16850"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0665"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rt57i_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "rev.8.00.95",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rt57i:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rt58i_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "rev.9.01.51",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rt58i:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:nvr500_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "rev.11.00.36",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:nvr500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:yamaha:rtx810_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "rev.11.01.31",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:yamaha:rtx810:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-0665"
}
]
},
"cve": "CVE-2018-0665",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.2,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.1,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "Single",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 2.7,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2018-000093",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"confidentialityImpact": "NONE",
"exploitabilityScore": 5.1,
"id": "CNVD-2018-16850",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.2,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.1,
"id": "VHN-118867",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 4.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2018-000093",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "High",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-0665",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "IPA",
"id": "JVNDB-2018-000093",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2018-16850",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-340",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-118867",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16850"
},
{
"db": "VULHUB",
"id": "VHN-118867"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0665"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-340"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user\u0027s web browser. This is a different vulnerability from CVE-2018-0666. The management screen of multiple network devices provided by Yamaha Corporation contains multiple script injection vulnerabilities (CWE-74). The following researchers reported the vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2018-0665 Hayato Doi of Kanazawa Institute of Technology CVE-2018-0666 Tomonori Yamamoto of Mitsui Bussan Secure Directions, Inc.In the case where multiple administrators manage an affected device, an administrator with malicious intent may embed an arbitrary script into the management screen. The embedded script may be executed when another administrator logs into the screen. YamahaBroadband VoIPRouterRT57i and so on are all Yamaha Corporation router products. NVR500 Broadband VoIP Router is a router. A security vulnerability exists in the management interface in several Yamaha products. The following products and versions are affected: Yamaha Corporation FWX120 Firewall Rev.11.03.25 and earlier; NVR500 Broadband VoIP Router Rev.11.00.36 and earlier; RT57i Broadband VoIP Router Rev.8.00.95 and earlier; RT58i Broadband VoIP Router Rev.9.01.51 and earlier versions; RTX810 Gigabit VPN Router Rev.11.01.33 and earlier versions",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-0665"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "CNVD",
"id": "CNVD-2018-16850"
},
{
"db": "VULHUB",
"id": "VHN-118867"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVN",
"id": "JVN69967692",
"trust": 3.1
},
{
"db": "NVD",
"id": "CVE-2018-0665",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201809-340",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2018-16850",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-118867",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16850"
},
{
"db": "VULHUB",
"id": "VHN-118867"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0665"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-340"
}
]
},
"id": "VAR-201901-0719",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16850"
},
{
"db": "VULHUB",
"id": "VHN-118867"
}
],
"trust": 1.6104166666666666
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16850"
}
]
},
"last_update_date": "2023-12-18T13:08:13.508000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Yamaha Corporation website",
"trust": 0.8,
"url": "http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn69967692.html"
},
{
"title": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION website",
"trust": 0.8,
"url": "https://web116.jp/ced/support/news/contents/2018/20180829b.html"
},
{
"title": "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION website",
"trust": 0.8,
"url": "https://flets-w.com/solution/kiki_info/info/180829.html"
},
{
"title": "YamahaCorporation multiple products have script injection vulnerability patches",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/138965"
},
{
"title": "Multiple Yamaha Corporation Product security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=84654"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16850"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-340"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-79",
"trust": 0.8
},
{
"problemtype": "CWE-74",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-118867"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0665"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://jvn.jp/en/jp/jvn69967692/index.html"
},
{
"trust": 1.7,
"url": "http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn69967692.html"
},
{
"trust": 1.7,
"url": "https://flets-w.com/solution/kiki_info/info/180829.html"
},
{
"trust": 1.7,
"url": "https://web116.jp/ced/support/news/contents/2018/20180829b.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0665"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0666"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-0665"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-0666"
},
{
"trust": 0.6,
"url": "https://jvn.jp/en/jp/jvn69967692/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-16850"
},
{
"db": "VULHUB",
"id": "VHN-118867"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0665"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-340"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2018-16850"
},
{
"db": "VULHUB",
"id": "VHN-118867"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"db": "NVD",
"id": "CVE-2018-0665"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-340"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-08-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-16850"
},
{
"date": "2019-01-09T00:00:00",
"db": "VULHUB",
"id": "VHN-118867"
},
{
"date": "2018-08-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"date": "2019-01-09T23:29:01.373000",
"db": "NVD",
"id": "CVE-2018-0665"
},
{
"date": "2018-09-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-340"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-08-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-16850"
},
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-118867"
},
{
"date": "2019-08-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-000093"
},
{
"date": "2020-08-24T17:37:01.140000",
"db": "NVD",
"id": "CVE-2018-0665"
},
{
"date": "2020-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-340"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-340"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple script injection vulnerabilities in multiple Yamaha network devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-000093"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-340"
}
],
"trust": 0.6
}
}
cve-2013-7310
Vulnerability from cvelistv5
Published
2014-01-23 17:00
Modified
2024-09-16 20:47
Severity ?
EPSS score ?
Summary
The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU96465452.html | x_refsource_CONFIRM | |
| http://www.kb.cert.org/vuls/id/229804 | third-party-advisory, x_refsource_CERT-VN | |
| http://www.kb.cert.org/vuls/id/CKIG-9AAHPZ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU96465452.html"
},
{
"name": "VU#229804",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/229804"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/CKIG-9AAHPZ"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-01-23T17:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU96465452.html"
},
{
"name": "VU#229804",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/229804"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.kb.cert.org/vuls/id/CKIG-9AAHPZ"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7310",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU96465452.html",
"refsource": "CONFIRM",
"url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU96465452.html"
},
{
"name": "VU#229804",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/229804"
},
{
"name": "http://www.kb.cert.org/vuls/id/CKIG-9AAHPZ",
"refsource": "CONFIRM",
"url": "http://www.kb.cert.org/vuls/id/CKIG-9AAHPZ"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7310",
"datePublished": "2014-01-23T17:00:00Z",
"dateReserved": "2014-01-23T00:00:00Z",
"dateUpdated": "2024-09-16T20:47:17.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-5548
Vulnerability from cvelistv5
Published
2020-04-01 11:15
Modified
2024-08-04 08:30
Severity ?
EPSS score ?
Summary
Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210 firmware Rev.14.01.33 and earlier, RTX3500 firmware Rev.14.00.26 and earlier, and RTX5000 firmware Rev.14.00.26 and earlier), Yamaha Broadband VoIP Router(NVR500 firmware Rev.11.00.38 and earlier), and Yamaha Firewall(FWX120 firmware Rev.11.03.27 and earlier) allow remote attackers to cause a denial of service via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html | x_refsource_MISC | |
| https://jvn.jp/en/jp/JVN38732359/index.html | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Yamaha Corporation | Yamaha network devices |
Version: Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210 firmware Rev.14.01.33 and earlier, RTX3500 firmware Rev.14.00.26 and earlier, and RTX5000 firmware Rev.14.00.26 and earlier), Yamaha Broadband VoIP Router(NVR500 firmware Rev.11.00.38 and earlier), and Yamaha Firewall(FWX120 firmware Rev.11.03.27 and earlier) |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:30:24.549Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN38732359/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Yamaha network devices",
"vendor": "Yamaha Corporation",
"versions": [
{
"status": "affected",
"version": "Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210 firmware Rev.14.01.33 and earlier, RTX3500 firmware Rev.14.00.26 and earlier, and RTX5000 firmware Rev.14.00.26 and earlier), Yamaha Broadband VoIP Router(NVR500 firmware Rev.11.00.38 and earlier), and Yamaha Firewall(FWX120 firmware Rev.11.03.27 and earlier)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210 firmware Rev.14.01.33 and earlier, RTX3500 firmware Rev.14.00.26 and earlier, and RTX5000 firmware Rev.14.00.26 and earlier), Yamaha Broadband VoIP Router(NVR500 firmware Rev.11.00.38 and earlier), and Yamaha Firewall(FWX120 firmware Rev.11.03.27 and earlier) allow remote attackers to cause a denial of service via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial-of-service (DoS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-01T11:15:15",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jvn.jp/en/jp/JVN38732359/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2020-5548",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Yamaha network devices",
"version": {
"version_data": [
{
"version_value": "Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210 firmware Rev.14.01.33 and earlier, RTX3500 firmware Rev.14.00.26 and earlier, and RTX5000 firmware Rev.14.00.26 and earlier), Yamaha Broadband VoIP Router(NVR500 firmware Rev.11.00.38 and earlier), and Yamaha Firewall(FWX120 firmware Rev.11.03.27 and earlier)"
}
]
}
}
]
},
"vendor_name": "Yamaha Corporation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210 firmware Rev.14.01.33 and earlier, RTX3500 firmware Rev.14.00.26 and earlier, and RTX5000 firmware Rev.14.00.26 and earlier), Yamaha Broadband VoIP Router(NVR500 firmware Rev.11.00.38 and earlier), and Yamaha Firewall(FWX120 firmware Rev.11.03.27 and earlier) allow remote attackers to cause a denial of service via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial-of-service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html",
"refsource": "MISC",
"url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html"
},
{
"name": "https://jvn.jp/en/jp/JVN38732359/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/en/jp/JVN38732359/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2020-5548",
"datePublished": "2020-04-01T11:15:15",
"dateReserved": "2020-01-06T00:00:00",
"dateUpdated": "2024-08-04T08:30:24.549Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2014-01-23 17:55
Modified
2024-11-21 02:00
Severity ?
Summary
The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:fwx120:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DBE3E44-1A97-4B6D-912C-609D8B45D105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rt105:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0FB4757E-B1D3-4B09-8545-2278263991C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rt107e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7824CDA3-7993-4EBF-9091-633009232300",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rt140:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6C928105-7205-48E0-923B-4BABE8526D9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rt250i:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87CF6460-AF46-4EC7-AAE2-4A926ED199AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rt300i:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B7F2620-BCED-4450-A928-1EA29E20609F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rtx1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D16744D-5082-44C2-8A49-CDAB851EE88B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rtx1100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9660F70D-A62D-44AC-9869-6A805E2714E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rtx1200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF07005-4053-4419-B9A7-F2591FF1F8F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rtx1500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0FE8C15B-5030-4AA8-8FF6-4EE23D4AF8E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rtx2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2EE0143C-2421-4BCF-A196-A04C04EFD757",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rtx3000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1A5187A4-5B0D-4ED8-B582-2A13CB3922BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:rtx810:-:*:*:*:*:*:*:*",
"matchCriteriaId": "32B7EF2A-748F-4EDE-82DD-B6D135097147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:yamaha:srt100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05CB1586-8031-46C7-89C7-C2F6B7818DF4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149."
},
{
"lang": "es",
"value": "La implementaci\u00f3n OSPF en routers Yamaha no considera la posibilidad de valores duplicados en paquetes Link State Advertisement (LSA) antes de realizar operaciones en la base de datos de LSA, lo que permite a atacantes remotos provocar una denegaci\u00f3n de servicio (interrupci\u00f3n de enrutamiento) u obtener informaci\u00f3n sensible de paquetes a trav\u00e9s de un paquete LSA, una vulnerabilidad relacionada con CVE-2013-0149."
}
],
"id": "CVE-2013-7310",
"lastModified": "2024-11-21T02:00:42.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 5.5,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-01-23T17:55:05.277",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/229804"
},
{
"source": "cve@mitre.org",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/CKIG-9AAHPZ"
},
{
"source": "cve@mitre.org",
"url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU96465452.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/229804"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/CKIG-9AAHPZ"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU96465452.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-04-01 12:15
Modified
2024-11-21 05:34
Severity ?
Summary
Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210 firmware Rev.14.01.33 and earlier, RTX3500 firmware Rev.14.00.26 and earlier, and RTX5000 firmware Rev.14.00.26 and earlier), Yamaha Broadband VoIP Router(NVR500 firmware Rev.11.00.38 and earlier), and Yamaha Firewall(FWX120 firmware Rev.11.03.27 and earlier) allow remote attackers to cause a denial of service via unspecified vectors.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| vultures@jpcert.or.jp | http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html | Mitigation, Vendor Advisory | |
| vultures@jpcert.or.jp | https://jvn.jp/en/jp/JVN38732359/index.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html | Mitigation, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jvn.jp/en/jp/JVN38732359/index.html | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| yamaha | rtx830_firmware | * | |
| yamaha | rtx830 | - | |
| yamaha | nvr510_firmware | * | |
| yamaha | nvr510 | - | |
| yamaha | nvr700w_firmware | * | |
| yamaha | nvr700w | - | |
| yamaha | rtx1210_firmware | * | |
| yamaha | rtx1210 | - | |
| yamaha | rtx5000_firmware | * | |
| yamaha | rtx5000 | - | |
| yamaha | rtx3500_firmware | * | |
| yamaha | rtx3500 | - | |
| yamaha | fwx120_firmware | * | |
| yamaha | fwx120 | - | |
| yamaha | rtx810_firmware | * | |
| yamaha | rtx810 | - | |
| yamaha | nvr500_firmware | * | |
| yamaha | nvr500 | - | |
| yamaha | rtx1200_firmware | * | |
| yamaha | rtx1200 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:yamaha:rtx830_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0B414D4B-8464-42CB-BE14-8ABFA26F1FDA",
"versionEndIncluding": "15.02.09",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:rtx830:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C585EA2A-C2E0-406E-A785-668C2D8C5D64",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:yamaha:nvr510_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "71966C3D-18F4-4101-8DCC-87208BBCF61B",
"versionEndIncluding": "15.01.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:nvr510:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1F29115C-CBD1-4648-A7BB-616DB70231FD",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:yamaha:nvr700w_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "87C14E67-7BE0-4BF5-8B0D-02305F5B831C",
"versionEndIncluding": "15.00.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:nvr700w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DF384051-AFEF-4CCD-BC7A-866EC2B87FFA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:yamaha:rtx1210_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6E11D8E2-E409-4D72-BEB0-49943D8EB1D5",
"versionEndIncluding": "14.01.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:rtx1210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38ABD757-E916-4DD3-B491-E37EEDEB601C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:yamaha:rtx5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1E337794-45D4-44B1-9B3B-363ED322CC6C",
"versionEndIncluding": "14.00.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:rtx5000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "14F68786-EBBA-4AB9-9E86-7806713B9117",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:yamaha:rtx3500_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "63F26DDF-CDA6-48C3-B755-947940CF5D77",
"versionEndIncluding": "14.00.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:rtx3500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4DE1FDA5-0F68-4104-9304-319E5F427E69",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:yamaha:fwx120_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E044DF7B-4118-4D02-9435-763A248DAC12",
"versionEndIncluding": "11.03.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:fwx120:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DBE3E44-1A97-4B6D-912C-609D8B45D105",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:yamaha:rtx810_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7BBB1629-0E21-498B-BD5B-E03E711AC42A",
"versionEndIncluding": "11.01.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:rtx810:-:*:*:*:*:*:*:*",
"matchCriteriaId": "32B7EF2A-748F-4EDE-82DD-B6D135097147",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:yamaha:nvr500_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AD0D03C1-7B13-42FE-B48B-FD12367D521B",
"versionEndIncluding": "11.00.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:nvr500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7A2BF515-DCF0-4EBB-AB33-2BEB8B926453",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:yamaha:rtx1200_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D0BE58B3-5B65-4A37-8E8C-53ACF39941FD",
"versionEndIncluding": "10.01.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:yamaha:rtx1200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF07005-4053-4419-B9A7-F2591FF1F8F7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210 firmware Rev.14.01.33 and earlier, RTX3500 firmware Rev.14.00.26 and earlier, and RTX5000 firmware Rev.14.00.26 and earlier), Yamaha Broadband VoIP Router(NVR500 firmware Rev.11.00.38 and earlier), and Yamaha Firewall(FWX120 firmware Rev.11.03.27 and earlier) allow remote attackers to cause a denial of service via unspecified vectors."
},
{
"lang": "es",
"value": "El Enrutador Yamaha LTE VoIP (NVR700W versiones de firmware Rev.15.00.15 y anteriores), el Enrutador Yamaha Gigabit VoIP (NVR510 versiones de firmware Rev.15.01.14 y anteriores), el Enrutador Yamaha Gigabit VPN (RTX810 versiones de firmware Rev.11.01.33 y anteriores, RTX830 versiones de firmware Rev .15.02.09 y anteriores, RTX1200 versiones de firmware Rev.10.01.76 y anteriores, RTX1210 versiones de firmware Rev.14.01.33 y anteriores, RTX3500 firmware Rev.14.00.26 y anteriores, y RTX5000 firmware Rev.14.00.26 y anteriores), el Enrutador Yamaha Broadband VoIP (NVR500 versiones de firmware Rev.11.00.38 y anteriores) y Yamaha Firewall (FWX120 versiones de firmware Rev.11.03.27 y anteriores), permiten a atacantes remotos causar una denegaci\u00f3n de servicio por medio de vectores no especificados."
}
],
"id": "CVE-2020-5548",
"lastModified": "2024-11-21T05:34:15.293",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-04-01T12:15:15.210",
"references": [
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Third Party Advisory"
],
"url": "https://jvn.jp/en/jp/JVN38732359/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://jvn.jp/en/jp/JVN38732359/index.html"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}