CVE-2021-37384

CRITICAL

Furukawa ONU Firmware < 1.2.0, < 1.5.0, < 1.4.0 - Unauthenticated Remote Code Execution via Web Interface

Title source: llm

Description

RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.

References (4)

Core 4

Core References

Not Applicable

https://cwe.mitre.org/data/definitions/94.html

Third Party Advisory

https://gist.githubusercontent.com/LuigiPolidorio/9fe61cf2edee63152161ffc52c39f6cd/raw/529cf49103e0fdf4eeb970fa1f62fa508ebe7c3c/reference.txt

Not Applicable

https://owasp.org/www-community/attacks/Code_Injection

Various Sources

https://www.softwall.com.br/cves/publicacao-rce-html-injection-furukawa/

Scores

CVSS v3 9.8

EPSS 0.0138

EPSS Percentile 68.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-94

Status published

Products (4)

furukawa/423-41w\/ac_firmware < 1.2.0

furukawa/ld420-10r_firmware < 1.4.0

furukawa/ld421-21w_firmware < 1.5.0

furukawa/ld421-21wv_firmware < 1.5.0

Published Jul 17, 2023

Tracked Since Feb 18, 2026