CVE-2018-0666

Description

Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0665.

6.8

CVSS

Severity: Medium

CVSS 3.0 •

CVSS 2.0 •

EPSS 0.19%

Third-Party Advisory jvn.jp Third-Party Advisory co.jp Third-Party Advisory flets-w.com Third-Party Advisory web116.jp

Affected: Yamaha Corporation Yamaha Broadband VoIP Router RT57i

Affected: Yamaha Corporation Yamaha Broadband VoIP Router RT58i

Affected: Yamaha Corporation Yamaha Broadband VoIP Router NVR500

Affected: Yamaha Corporation Yamaha Gigabit VPN Router RTX810

Affected: Yamaha Corporation Yamaha Firewall FWX120

Affected: NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION Biz Box Router N58i, N500, NVR500, and RTX810

Affected: NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Biz Box Router N58i, and N500

References

Link	Tags
https://flets-w.com/solution/kiki_info/info/180829.html	third party advisory
https://jvn.jp/en/jp/JVN69967692/index.html	third party advisory
https://web116.jp/ced/support/news/contents/2018/20180829b.html	third party advisory
http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN69967692.html	third party advisory

Frequently Asked Questions

What is the severity of CVE-2018-0666?: CVE-2018-0666 has been scored as a medium severity vulnerability.
How to fix CVE-2018-0666?: To fix CVE-2018-0666, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2018-0666 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2018-0666 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2018-0666?: CVE-2018-0666 affects Yamaha Corporation Yamaha Broadband VoIP Router RT57i, Yamaha Corporation Yamaha Broadband VoIP Router RT58i, Yamaha Corporation Yamaha Broadband VoIP Router NVR500, Yamaha Corporation Yamaha Gigabit VPN Router RTX810, Yamaha Corporation Yamaha Firewall FWX120, NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION Biz Box Router N58i, N500, NVR500, and RTX810, NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Biz Box Router N58i, and N500.