Resource exhaustion in Yamaha Corporation products - CVE-2020-5548

Vulnerability identifier: #VU26467

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2020-5548

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Yamaha Corporation

Affected software:
Yamaha LTE VoIP Router
Yamaha Gigabit VoIP Router
Yamaha Gigabit VPN Router
Yamaha Broadband VoIP Router
Yamaha Firewall
NVR700W
NVR510
NVR500
RTX810
RTX830
RTX1200
RTX1210
RTX3500
RTX5000
FWX120

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an issue in processing received packet. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://jvn.jp/en/jp/JVN38732359/index.html
• http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN38732359.html