Medium severity · published Nov 24, 2021
CVE-2021-20844
Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W…
5.7
CVSS
1%
EPSS
No
On KEV
Description
Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to obtain sensitive information via a specially crafted web page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BB
Biz Box Nvr510 Firmware · Ntt-west
before 15.01.18 · source: NVD
BB
Biz Box Nvr700w Firmware · Ntt-west
through 15.00.19 · source: NVD
BB
Biz Box Rtx1210 Firmware · Ntt-west
through 14.01.38 · source: NVD
BB
Biz Box Rtx830 Firmware · Ntt-west
through 15.02.17 · source: NVD
NF
Nvr510 Firmware · Yamaha
through 15.01.18 · source: NVD
NF
Nvr700w Firmware · Yamaha
through 15.00.19 · source: NVD
RF
Rtx1210 Firmware · Yamaha
through 14.01.38 · source: NVD
RF
Rtx830 Firmware · Yamaha
through 15.02.17 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20844
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20844
Mitigation
http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.html
Mitigation
https://business.ntt-east.co.jp/topics/2021/11_09.html
Mitigation
https://jvn.jp/en/vu/JVNVU91161784/index.html
Mitigation
https://www.ntt-west.co.jp/smb/kiki_info/info/211109.html
More from Biz Box Nvr510 Firmware
5.4
CVE-2021-20843
Cross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210…