Resource exhaustion in Yamaha Corporation products - CVE-2020-5548

Vulnerability identifier: #VU26467

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-5548

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an issue in processing received packet. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

NVR500
RTX1210
RTX1200
RTX3500
RTX830
RTX810
RTX5000
NVR510
FWX120
NVR700W
Yamaha LTE VoIP Router
Yamaha Firewall
Yamaha Broadband VoIP Router
Yamaha Gigabit VPN Router
Yamaha Gigabit VoIP Router

Install updates from vendor's website.

NVR500 - update to 11.00.41
RTX1210 - update to 14.01.34
RTX1200 - update to 10.01.78
RTX3500 - update to 14.00.27
RTX830 - update to 15.02.10
RTX810 - update to 11.01.34
RTX5000 - update to 14.00.27
NVR510 - update to 15.01.15
FWX120 - update to 11.03.29
NVR700W - update to 15.00.16

• https://jvn.jp/en/jp/JVN38732359/index.html
• http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html

• Denial of service in multiple Yamaha network devices