CVE-2021-20844
Last modified
CVE-2021-20844 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to obtain sensitive information via a specially crafted web page.. EPSS estimates a 0.93% chance of exploitation in the next 30 days.
Description
Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to obtain sensitive information via a specially crafted web page.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Yamaha | Rtx830 Firmware | <= 15.02.17 |
| Yamaha | Nvr510 Firmware | <= 15.01.18 |
| Yamaha | Nvr700w Firmware | <= 15.00.19 |
| Yamaha | Rtx1210 Firmware | <= 14.01.38 |
| Ntt-West | Biz Box Rtx830 Firmware | <= 15.02.17 |
| Ntt-West | Biz Box Nvr510 Firmware | < 15.01.18 |
| Ntt-West | Biz Box Nvr700w Firmware | <= 15.00.19 |
| Ntt-West | Biz Box Rtx1210 Firmware | <= 14.01.38 |
References
- http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.htmlMitigation, Vendor Advisory
- https://business.ntt-east.co.jp/topics/2021/11_09.htmlMitigation, Vendor Advisory
- https://jvn.jp/en/vu/JVNVU91161784/index.htmlMitigation, Third Party Advisory
- https://www.ntt-west.co.jp/smb/kiki_info/info/211109.htmlMitigation, Vendor Advisory
- http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.htmlMitigation, Vendor Advisory
- https://business.ntt-east.co.jp/topics/2021/11_09.htmlMitigation, Vendor Advisory
- https://jvn.jp/en/vu/JVNVU91161784/index.htmlMitigation, Third Party Advisory
- https://www.ntt-west.co.jp/smb/kiki_info/info/211109.htmlMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-20844?
How severe is CVE-2021-20844?
How do I fix CVE-2021-20844?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-20839Office Server Document Converter V7.2MR4 and earlier and V7.…6.5
- CVE-2021-2084Vulnerability in the Oracle CRM Technical Foundation product…8.2
- CVE-2021-20840Cross-site scripting vulnerability in Booking Package - Appo…6.1
- CVE-2021-20841Improper access control in Management screen of EC-CUBE 2 se…6.5
- CVE-2021-20842Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2…6.5
- CVE-2021-20843Cross-site script inclusion vulnerability in the Web GUI of …5.4
- CVE-2021-20845Cross-site request forgery (CSRF) vulnerability in Unlimited…8.8
- CVE-2021-20846Cross-site request forgery (CSRF) vulnerability in Push Noti…8.8
- CVE-2021-20847Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (…6.1
- CVE-2021-20848Cross-site scripting vulnerability in rwtxt versions prior t…6.1
- CVE-2021-2085Vulnerability in the Oracle CRM Technical Foundation product…8.2
- CVE-2021-20850PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4…9.8
Are you affected by CVE-2021-20844?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST