CVE-2018-0665: Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to…

Description

Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0666.

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Adjacent

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 51% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

NF

Nvr500 Firmware · Yamaha

through rev.11.00.36 · source: NVD

RF

Rt57i Firmware · Yamaha

through rev.8.00.95 · source: NVD

RF

Rt58i Firmware · Yamaha

through rev.9.01.51 · source: NVD

RF

Rtx810 Firmware · Yamaha

through rev.11.01.31 · source: NVD