Vulnerability-Lookup

GHSA-7M3J-V6WQ-HR22

Vulnerability from github – Published: 2023-07-17 21:31 – Updated: 2024-04-04 06:11

Details

A remote command execution (RCE) vulnerability in the web interface component of Furukawa 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 allows unauthenticated attackers to send arbitrary commands to the device via unspecified vectors.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-37384"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-17T21:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "A remote command execution (RCE) vulnerability in the web interface component of Furukawa 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 allows unauthenticated attackers to send arbitrary commands to the device via unspecified vectors.",
  "id": "GHSA-7m3j-v6wq-hr22",
  "modified": "2024-04-04T06:11:55Z",
  "published": "2023-07-17T21:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37384"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/94.html"
    },
    {
      "type": "WEB",
      "url": "https://gist.githubusercontent.com/LuigiPolidorio/9fe61cf2edee63152161ffc52c39f6cd/raw/529cf49103e0fdf4eeb970fa1f62fa508ebe7c3c/reference.txt"
    },
    {
      "type": "WEB",
      "url": "https://owasp.org/www-community/attacks/Code_Injection"
    },
    {
      "type": "WEB",
      "url": "https://www.softwall.com.br/cves/publicacao-rce-html-injection-furukawa"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2021-37384 (GCVE-0-2021-37384)

Vulnerability from cvelistv5 – Published: 2023-07-17 00:00 – Updated: 2024-08-04 01:16

Summary

RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

mitre

References

4 references

URL	Tags
https://cwe.mitre.org/data/definitions/94.html
https://owasp.org/www-community/attacks/Code_Injection
https://gist.githubusercontent.com/LuigiPolidorio…
https://www.softwall.com.br/cves/publicacao-rce-h…

Impacted products

4 products

Vendor	Product	Version
furukawa	ld420-10r_firmware	Affected: 0 , < 1.4.0 (custom) cpe:2.3:o:furukawa:ld420-10r_firmware:-:::::::*
furukawa	ld421-21w_firmware	Affected: 0 , < 1.5.0 (custom) cpe:2.3:o:furukawa:ld421-21w_firmware:-:::::::*
furukawa	ld421-21wv_firmware	Affected: 0 , < 1.5.0 (custom) cpe:2.3:o:furukawa:ld421-21wv_firmware:-:::::::*
furukawa	423-41w\/ac_firmware	Affected: 0 , < 1.2.0 (custom) cpe:2.3:o:furukawa:423-41w\/ac_firmware:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:furukawa:ld420-10r_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ld420-10r_firmware",
            "vendor": "furukawa",
            "versions": [
              {
                "lessThan": "1.4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:furukawa:ld421-21w_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ld421-21w_firmware",
            "vendor": "furukawa",
            "versions": [
              {
                "lessThan": "1.5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:furukawa:ld421-21wv_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ld421-21wv_firmware",
            "vendor": "furukawa",
            "versions": [
              {
                "lessThan": "1.5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:furukawa:423-41w\\/ac_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "423-41w\\/ac_firmware",
            "vendor": "furukawa",
            "versions": [
              {
                "lessThan": "1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-37384",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T16:21:43.983284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T17:34:26.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:16:03.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cwe.mitre.org/data/definitions/94.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://owasp.org/www-community/attacks/Code_Injection"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.githubusercontent.com/LuigiPolidorio/9fe61cf2edee63152161ffc52c39f6cd/raw/529cf49103e0fdf4eeb970fa1f62fa508ebe7c3c/reference.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.softwall.com.br/cves/publicacao-rce-html-injection-furukawa/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-16T21:53:14.896Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://cwe.mitre.org/data/definitions/94.html"
        },
        {
          "url": "https://owasp.org/www-community/attacks/Code_Injection"
        },
        {
          "url": "https://gist.githubusercontent.com/LuigiPolidorio/9fe61cf2edee63152161ffc52c39f6cd/raw/529cf49103e0fdf4eeb970fa1f62fa508ebe7c3c/reference.txt"
        },
        {
          "url": "https://www.softwall.com.br/cves/publicacao-rce-html-injection-furukawa/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-37384",
    "datePublished": "2023-07-17T00:00:00.000Z",
    "dateReserved": "2021-07-21T00:00:00.000Z",
    "dateUpdated": "2024-08-04T01:16:03.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-7M3J-V6WQ-HR22

CVE-2021-37384 (GCVE-0-2021-37384)

Tags

Sightings

Nomenclature