SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-20844

Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote…

MEDIUM 5.7EPSS 0.96%

Does this matter?

Lower severity and a low EPSS score (0.96%). Track it; it rarely justifies an emergency change on its own.

Description

Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to obtain sensitive information via a specially crafted web page.

CVSS 3.1
5.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS
0.96% probability · 61th percentile
Public exploits
None in Exploit-DB
CISA KEV
Not listed
Weakness
CWE-116
Affected
yamaha/rtx830 firmware · yamaha/nvr510 firmware · yamaha/nvr700w firmware · yamaha/rtx1210 firmware · ntt-west/biz box rtx830 firmware · ntt-west/biz box nvr510 firmware · ntt-west/biz box nvr700w firmware · ntt-west/biz box rtx1210 firmware
Source
vultures@jpcert.or.jp
EPSS trend
0%3%5%26 October 2026: 0.96%26 October 202626 October 2026

EPSS 1.0% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.