CVE-2021-37384

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-373867.5Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injection vulnerability via CVE-2021-373889.8A buffer overflow in D-Link DIR-615 C2 3.03WW. The ping_ipaddr parameter in ping_response.cgi POST request allows an attacker to crash the w CVE-2021-373896.1Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter.CVE-2021-37397.1A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bu CVE-2021-373906.1A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).CVE-2021-373915.4A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/socia CVE-2021-373925.4In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enable CVE-2021-373935.4In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password CVE-2021-373948.8In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.CVE-2021-37406.8A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions CVE-2021-374009.8An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may b CVE-2021-374019.8An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC use