JVN#69967692: Multiple script injection vulnerabilities in multiple Yamaha network devices

The management screen of multiple network devices provided by Yamaha Corporation contains multiple script injection vulnerabilities (CWE-74).

Impact

In the case where multiple administrators manage an affected device, an administrator with malicious intent may embed an arbitrary script into the management screen. The embedded script may be executed when another administrator logs into the screen.

Solution

Update the Firmware
Apply the firmware update according to the information provided by the developer.

Products Affected

• Yamaha Broadband VoIP Router RT57i Rev.8.00.95 and earlier
• Yamaha Broadband VoIP Router RT58i Rev.9.01.51 and earlier
• Yamaha Broadband VoIP Router NVR500 Rev.11.00.36 and earlier
• Yamaha Gigabit VPN Router RTX810 Rev.11.01.31 and earlier
• Yamaha Firewall FWX120 Rev.11.03.25 and earlier