CVE-2018-0665 Cross-site scripting in Biz Box Router N58i, N500, NVR500, and RTX810
Administrative users can inject scripts into router configuration fields, potentially executing code in other administrators' browsers to compromise accounts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-0665?
CVE-2018-0665 is a medium-severity cross-site scripting vulnerability in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Biz Box Router N58i, N500, NVR500, and RTX810, published on 9 Jan 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0666.
Which versions are affected by CVE-2018-0665?
It affects 4 products.
Products include Yamaha Nvr500 Firmware, Yamaha Rt57i Firmware, Yamaha Rt58i Firmware, Yamaha Rtx810 Firmware.
How do I fix CVE-2018-0665?
No fix has been published for CVE-2018-0665 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-0665 being exploited?
There is no known exploitation of CVE-2018-0665 in the wild and no public exploit code.
Other vulnerabilities in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Biz Box Router N58i, N500, NVR500, and RTX810
Sources
Also known as GHSA-qj49-xjv5-g9qj.