CVE-2021-37384
CRITICALCVSS 9.8/10EPSS 1.38%
Last modified
CVE-2021-37384 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.. EPSS estimates a 1.38% chance of exploitation in the next 30 days.
Description
RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Furukawa | 423-41w\/Ac Firmware | < 1.2.0 |
| Furukawa | Ld421-21w Firmware | < 1.5.0 |
| Furukawa | Ld420-10r Firmware | < 1.4.0 |
| Furukawa | Ld421-21wv Firmware | < 1.5.0 |
References
- https://cwe.mitre.org/data/definitions/94.htmlNot Applicable
- https://owasp.org/www-community/attacks/Code_InjectionNot Applicable
- https://cwe.mitre.org/data/definitions/94.htmlNot Applicable
- https://owasp.org/www-community/attacks/Code_InjectionNot Applicable
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-37384?
RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.
How severe is CVE-2021-37384?
CVE-2021-37384 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.38% probability of exploitation in the next 30 days.
How do I fix CVE-2021-37384?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-37376Cross Site Scripting (XSS) vulnerability in Teradek Bond, Bo…5.4
- CVE-2021-37377Cross Site Scripting (XSS) vulnerability in Teradek Brik fir…5.4
- CVE-2021-37378Cross Site Scripting (XSS) vulnerability in Teradek Cube and…5.4
- CVE-2021-37379Cross Site Scripting (XSS) vulnerability in Teradek Sphere a…5.4
- CVE-2021-3738In DCE/RPC it is possible to share the handles (cookies for …8.8
- CVE-2021-37381Southsoft GMIS 5.0 is vulnerable to CSRF attacks. Attackers …8.8
- CVE-2021-37386Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-2…7.5
- CVE-2021-37388A buffer overflow in D-Link DIR-615 C2 3.03WW. The ping_ipad…9.8
- CVE-2021-37389Chamilo 1.11.14 allows stored XSS via main/install/index.php…6.1
- CVE-2021-3739A NULL pointer dereference flaw was found in the btrfs_rm_de…7.1
- CVE-2021-37390A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in …6.1
- CVE-2021-37391A user without privileges in Chamilo LMS 1.11.14 can send an…5.4
Are you affected by CVE-2021-37384?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST