PT-2023-12317 · Furukawa · Furukawa 423-41W/Ac+2

Published 2023-07-17 · Updated 2024-08-01 · CVE-2021-37384

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Furukawa ONU models (affected versions not specified) Furukawa 423-41W/AC versions prior to 1.1.4 Furukawa LD421-21W versions prior to 1.3.3

Description A Remote Code Execution (RCE) vulnerability was found, allowing remote unauthenticated users to send arbitrary commands to the device via the web interface. This issue affects the web interface component and enables unauthenticated attackers to execute commands on the device.

Recommendations For Furukawa 423-41W/AC versions prior to 1.1.4, update to version 1.1.4 or later. For Furukawa LD421-21W versions prior to 1.3.3, update to version 1.3.3 or later. As a temporary workaround, consider restricting access to the web interface until a patch is applied.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-37384

Affected Products

Furukawa 423-41W/Ac

Furukawa Ld421-21W

Furukawa Onu

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-37384 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37384 · Vendor Advisory
• https://gist.githubusercontent.com/LuigiPolidorio/9fe61cf2edee63152161ffc52c39f6cd/raw/529cf49103e0fdf4eeb970fa1f62fa508ebe7c3c/reference.txt · Note
• https://softwall.com.br/cves/publicacao-rce-html-injection-furukawa · Note
• https://owasp.org/www-community/attacks/Code_Injection · Note
• https://cwe.mitre.org/data/definitions/94.html · Note
• https://t.me/cibsecurity/66853 · Telegram Post