ByteOS Network

Vulnerability Details :

CVE-2021-20844

Assigner-jpcert

Assigner Org ID-ede6fdc4-6654-4307-a26d-3331c018e2ce

Published At-24 Nov, 2021 | 08:25

Updated At-03 Aug, 2024 | 17:53

Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to obtain sensitive information via a specially crafted web page.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:jpcert

Assigner Org ID:ede6fdc4-6654-4307-a26d-3331c018e2ce

Published At:24 Nov, 2021 | 08:25

Updated At:03 Aug, 2024 | 17:53

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

Yamaha Corporation

Product

RTX830, NVR510, NVR700W, RTX1210

Versions

Affected

RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, RTX1210 Rev.14.01.38 and earlier

Problem Types

Type	CWE ID	Description
text	N/A	Improper Neutralization of HTTP Headers for Scripting Syntax

Type: text

CWE ID: N/A

Description: Improper Neutralization of HTTP Headers for Scripting Syntax

References

Hyperlink	Resource
https://www.ntt-west.co.jp/smb/kiki_info/info/211109.html	x_refsource_MISC
https://business.ntt-east.co.jp/topics/2021/11_09.html	x_refsource_MISC
http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.html	x_refsource_MISC
https://jvn.jp/en/vu/JVNVU91161784/index.html	x_refsource_MISC

Hyperlink: https://www.ntt-west.co.jp/smb/kiki_info/info/211109.html

Resource:

x_refsource_MISC

Hyperlink: https://business.ntt-east.co.jp/topics/2021/11_09.html

Resource:

x_refsource_MISC

Hyperlink: http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.html

Resource:

x_refsource_MISC

Hyperlink: https://jvn.jp/en/vu/JVNVU91161784/index.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.ntt-west.co.jp/smb/kiki_info/info/211109.html	x_refsource_MISC x_transferred
https://business.ntt-east.co.jp/topics/2021/11_09.html	x_refsource_MISC x_transferred
http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.html	x_refsource_MISC x_transferred
https://jvn.jp/en/vu/JVNVU91161784/index.html	x_refsource_MISC x_transferred

Hyperlink: https://www.ntt-west.co.jp/smb/kiki_info/info/211109.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://business.ntt-east.co.jp/topics/2021/11_09.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://jvn.jp/en/vu/JVNVU91161784/index.html

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:vultures@jpcert.or.jp

Published At:24 Nov, 2021 | 16:15

Updated At:30 Nov, 2021 | 07:12

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 5.7

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 3.5

Base severity: LOW

Vector:

AV:N/AC:M/Au:S/C:P/I:N/A:N

CPE Matches

yamaha>>rtx830_firmware>>Versions up to 15.02.17(inclusive)

cpe:2.3:o:yamaha:rtx830_firmware:*:*:*:*:*:*:*:*

yamaha>>rtx830>>-

cpe:2.3:h:yamaha:rtx830:-:*:*:*:*:*:*:*

yamaha>>nvr510_firmware>>Versions up to 15.01.18(inclusive)

cpe:2.3:o:yamaha:nvr510_firmware:*:*:*:*:*:*:*:*

yamaha>>nvr510>>-

cpe:2.3:h:yamaha:nvr510:-:*:*:*:*:*:*:*

yamaha>>nvr700w_firmware>>Versions up to 15.00.19(inclusive)

cpe:2.3:o:yamaha:nvr700w_firmware:*:*:*:*:*:*:*:*

yamaha>>nvr700w>>-

cpe:2.3:h:yamaha:nvr700w:-:*:*:*:*:*:*:*

yamaha>>rtx1210_firmware>>Versions up to 14.01.38(inclusive)

cpe:2.3:o:yamaha:rtx1210_firmware:*:*:*:*:*:*:*:*

yamaha>>rtx1210>>-

cpe:2.3:h:yamaha:rtx1210:-:*:*:*:*:*:*:*

ntt-west>>biz_box_rtx830_firmware>>Versions up to 15.02.17(inclusive)

cpe:2.3:o:ntt-west:biz_box_rtx830_firmware:*:*:*:*:*:*:*:*

ntt-west>>biz_box_rtx830>>-

cpe:2.3:h:ntt-west:biz_box_rtx830:-:*:*:*:*:*:*:*

ntt-west>>biz_box_nvr510_firmware>>Versions before 15.01.18(exclusive)

cpe:2.3:o:ntt-west:biz_box_nvr510_firmware:*:*:*:*:*:*:*:*

ntt-west>>biz_box_nvr510>>-

cpe:2.3:h:ntt-west:biz_box_nvr510:-:*:*:*:*:*:*:*

ntt-west>>biz_box_nvr700w_firmware>>Versions up to 15.00.19(inclusive)

cpe:2.3:o:ntt-west:biz_box_nvr700w_firmware:*:*:*:*:*:*:*:*

ntt-west>>biz_box_nvr700w>>-

cpe:2.3:h:ntt-west:biz_box_nvr700w:-:*:*:*:*:*:*:*

ntt-west>>biz_box_rtx1210_firmware>>Versions up to 14.01.38(inclusive)

cpe:2.3:o:ntt-west:biz_box_rtx1210_firmware:*:*:*:*:*:*:*:*

ntt-west>>biz_box_rtx1210>>-

cpe:2.3:h:ntt-west:biz_box_rtx1210:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-116	Primary	nvd@nist.gov

CWE ID: CWE-116

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.html	vultures@jpcert.or.jp	Mitigation Vendor Advisory
https://business.ntt-east.co.jp/topics/2021/11_09.html	vultures@jpcert.or.jp	Mitigation Vendor Advisory
https://jvn.jp/en/vu/JVNVU91161784/index.html	vultures@jpcert.or.jp	Mitigation Third Party Advisory
https://www.ntt-west.co.jp/smb/kiki_info/info/211109.html	vultures@jpcert.or.jp	Mitigation Vendor Advisory

Hyperlink: http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91161784.html

Source: vultures@jpcert.or.jp

Resource:

Mitigation

Vendor Advisory

Hyperlink: https://business.ntt-east.co.jp/topics/2021/11_09.html

Source: vultures@jpcert.or.jp

Resource:

Mitigation

Vendor Advisory

Hyperlink: https://jvn.jp/en/vu/JVNVU91161784/index.html

Source: vultures@jpcert.or.jp

Resource:

Mitigation

Third Party Advisory

Hyperlink: https://www.ntt-west.co.jp/smb/kiki_info/info/211109.html

Source: vultures@jpcert.or.jp

Resource:

Mitigation

Vendor Advisory

Similar CVEs

2Records found

CVE-2021-22254

Matching Score-4

Assigner-GitLab Inc.

View Details

Matching Score-4

Assigner-GitLab Inc.

CVSS Score-3.1||LOW

EPSS-0.87% / 54.82%

7 Day CHG~0.00%

Published-20 Aug, 2021 | 17:37

Updated-03 Aug, 2024 | 18:37

Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 and 13.12.9.

Vendor-GitLab Inc.

Product-gitlab GitLab

CWE ID-CWE-116

Improper Encoding or Escaping of Output

CVE-2025-4084

Matching Score-4

Assigner-Mozilla Corporation

View Details

Matching Score-4

Assigner-Mozilla Corporation

CVSS Score-5.7||MEDIUM

EPSS-0.37% / 29.43%

7 Day CHG+0.03%

Published-29 Apr, 2025 | 13:13

Updated-13 Apr, 2026 | 15:16

Potential local code execution in "copy as cURL" command

Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox ESR 128.10, Firefox ESR 115.23, and Thunderbird 128.10.

Vendor-Mozilla Corporation

Product-firefox thunderbird Thunderbird Firefox

CWE ID-CWE-116

Improper Encoding or Escaping of Output

CVE-2021-20844

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs