What’s Vulnerable › Vulnerabilities

CVE-2021-37384

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-17 · updated 2026-06-17
• Weakness: CWE-94

Description

RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.

Affected products

• Furukawa 423-41W/Ac Firmware: before 1.2.0 — fixed in 1.2.0
• Furukawa Ld420-10R Firmware: before 1.4.0 — fixed in 1.4.0
• Furukawa Ld421-21W Firmware: before 1.5.0 — fixed in 1.5.0
• Furukawa Ld421-21Wv Firmware: before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: Furukawa 423-41W/Ac Firmware 1.2.0; Furukawa Ld420-10R Firmware 1.4.0; Furukawa Ld421-21W Firmware 1.5.0; Furukawa Ld421-21Wv Firmware 1.5.0. Check the vendor advisory for mitigations.

References

• https://cwe.mitre.org/data/definitions/94.html
• https://gist.githubusercontent.com/LuigiPolidorio/9fe61cf2edee63152161ffc52c39f6cd/raw/529cf49103e0fdf4eeb970fa1f62fa508ebe7c3c/reference.txt
• https://owasp.org/www-community/attacks/Code_Injection
• https://www.softwall.com.br/cves/publicacao-rce-html-injection-furukawa/
• https://cwe.mitre.org/data/definitions/94.html
• https://gist.githubusercontent.com/LuigiPolidorio/9fe61cf2edee63152161ffc52c39f6cd/raw/529cf49103e0fdf4eeb970fa1f62fa508ebe7c3c/reference.txt
• https://owasp.org/www-community/attacks/Code_Injection
• https://www.softwall.com.br/cves/publicacao-rce-html-injection-furukawa/

Get alerted when CVE-2021-37384 or the next vulnerability affects your stack