Read the docs
TI-2018-00620 Aliases CVE-2018-0665GHSA-qj49-xjv5-g9qj

Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500…

Priority LOW 31Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0666.

Why it matters now

EPSS 0.00652 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Yamaha CorporationYamaha Broadband VoIP Router RT57iRev.8.00.95 and earlier—No fix listedCNA
Yamaha CorporationYamaha Broadband VoIP Router RT58iRev.9.01.51 and earlier—No fix listedCNA
Yamaha CorporationYamaha Broadband VoIP Router NVR500Rev.11.00.36 and earlier—No fix listedCNA
Yamaha CorporationYamaha Gigabit VPN Router RTX810Rev.11.01.31 and earlier—No fix listedCNA
Yamaha CorporationYamaha Firewall FWX120Rev.11.03.25 and earlier—No fix listedCNA
NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATIONBiz Box Router N58i, N500, NVR500, and RTX810all versions—No fix listedCNA
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATIONBiz Box Router N58i, and N500all versions—No fix listedCNA
  • Yamaha Broadband VoIP Router RT57i VendorYamaha Corporation Affected Rev.8.00.95 and earlier Fixed in — No fix listed CNA
  • Yamaha Broadband VoIP Router RT58i VendorYamaha Corporation Affected Rev.9.01.51 and earlier Fixed in — No fix listed CNA
  • Yamaha Broadband VoIP Router NVR500 VendorYamaha Corporation Affected Rev.11.00.36 and earlier Fixed in — No fix listed CNA
  • Yamaha Gigabit VPN Router RTX810 VendorYamaha Corporation Affected Rev.11.01.31 and earlier Fixed in — No fix listed CNA
  • Yamaha Firewall FWX120 VendorYamaha Corporation Affected Rev.11.03.25 and earlier Fixed in — No fix listed CNA
  • Biz Box Router N58i, N500, NVR500, and RTX810 VendorNIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION Affected all versions Fixed in — No fix listed CNA
  • Biz Box Router N58i, and N500 VendorNIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:yamaha:rt57i_firmware:*:*:*:*:*:*:*:*up to rev.8.00.95VulnerableYamaha Corporation
cpe:2.3:h:yamaha:rt57i:-:*:*:*:*:*:*:*not specified by NVDRunning onYamaha Corporation
cpe:2.3:o:yamaha:rt58i_firmware:*:*:*:*:*:*:*:*up to rev.9.01.51VulnerableYamaha Corporation
cpe:2.3:h:yamaha:rt58i:-:*:*:*:*:*:*:*not specified by NVDRunning onYamaha Corporation
cpe:2.3:o:yamaha:nvr500_firmware:*:*:*:*:*:*:*:*up to rev.11.00.36VulnerableYamaha Corporation
cpe:2.3:h:yamaha:nvr500:-:*:*:*:*:*:*:*not specified by NVDRunning onYamaha Corporation
cpe:2.3:o:yamaha:rtx810_firmware:*:*:*:*:*:*:*:*up to rev.11.01.31VulnerableYamaha Corporation
cpe:2.3:h:yamaha:rtx810:-:*:*:*:*:*:*:*not specified by NVDRunning onYamaha Corporation
  • cpe:2.3:o:yamaha:rt57i_firmware:*:*:*:*:*:*:*:* Versions up to rev.8.00.95 Vulnerable ·Yamaha Corporation
  • cpe:2.3:h:yamaha:rt57i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yamaha Corporation
  • cpe:2.3:o:yamaha:rt58i_firmware:*:*:*:*:*:*:*:* Versions up to rev.9.01.51 Vulnerable ·Yamaha Corporation
  • cpe:2.3:h:yamaha:rt58i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yamaha Corporation
  • cpe:2.3:o:yamaha:nvr500_firmware:*:*:*:*:*:*:*:* Versions up to rev.11.00.36 Vulnerable ·Yamaha Corporation
  • cpe:2.3:h:yamaha:nvr500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yamaha Corporation
  • cpe:2.3:o:yamaha:rtx810_firmware:*:*:*:*:*:*:*:* Versions up to rev.11.01.31 Vulnerable ·Yamaha Corporation
  • cpe:2.3:h:yamaha:rtx810:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yamaha Corporation

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-0665
  2. 2026-10-03 Alias added: GHSA-qj49-xjv5-g9qj
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Advisory 4

  • TI-2020-04518 Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP… CVSS 3.1HIGH 7.5
  • TI-2018-00621 Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500… CVSS 3.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences