Paper/Archive/CVE-2021-37384

CVE-2021-37384

furukawa ld420-10r_firmware — RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users t…

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 76.7.767 × 2015.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

ld420-10r_firmware< 1.4.01.4.0CISA-ADP

ld421-21w_firmware< 1.5.01.5.0CISA-ADP

ld421-21wv_firmware< 1.5.01.5.0CISA-ADP

423-41w\/ac_firmware< 1.2.01.2.0CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsoftwall.com.br/cves/publicacao-rce-html-injection-furukawa refcwe.mitre.org/data/definitions/94.html refowasp.org/www-community/attacks/Code_Injection refgist.githubusercontent.com/LuigiPolidorio/9fe61cf2edee63152161ffc52c39f6cd/raw/529cf49103e0fdf4eeb970fa1f62fa508ebe7c3c/reference.txt