CVE-2021-37386 in 423-41W-AC
Summary
by MITRE • 07/17/2023
Furukawa 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injection vulnerability via the serial number update function.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/25/2025
The vulnerability identified as CVE-2021-37386 affects Furukawa network devices including the 423-41W/AC and LD421-21W models prior to specific firmware versions. This represents a critical security flaw that undermines the integrity of device management interfaces. The vulnerability manifests through the serial number update function, which fails to properly sanitize user input, creating an avenue for malicious actors to inject arbitrary HTML code into the device's web interface. This type of vulnerability falls under the category of HTML injection as defined by CWE-79, which specifically addresses the insertion of malicious HTML code into web applications. The flaw exists in the input validation mechanisms of the device's management interface, where user-supplied data is not adequately filtered or escaped before being rendered in the browser context.
The operational impact of this vulnerability is substantial as it allows attackers to execute malicious scripts within the context of the device's web interface. An attacker who successfully exploits this vulnerability could potentially perform actions such as stealing session cookies, redirecting users to malicious sites, or executing unauthorized commands on the affected devices. The vulnerability specifically targets the serial number update functionality, which is typically used for device identification and management purposes. This creates a scenario where an attacker could manipulate the device's interface to display malicious content or redirect users to phishing sites. The attack vector is particularly concerning as it requires minimal privileges and can be exploited through standard web browser interactions, making it accessible to attackers with basic technical skills.
Security implications extend beyond simple HTML injection as this vulnerability could serve as a stepping stone for more sophisticated attacks within the network. The affected devices operate in industrial and commercial environments where network security is paramount, making such vulnerabilities particularly dangerous. Attackers could leverage this weakness to establish persistent access points within the network infrastructure, potentially leading to broader compromise of connected systems. The vulnerability's presence in firmware versions prior to v1.1.4 and v1.3.3 respectively indicates that this was a known issue that required firmware updates to address. Organizations utilizing these devices should immediately assess their network exposure and implement mitigation strategies including firmware updates, network segmentation, and monitoring for suspicious web interface activity. The ATT&CK framework categorizes this vulnerability under T1566 - Phishing and T1059 - Command and Scripting Interpreter, as it enables attackers to deliver malicious payloads through web interfaces and execute code within the device environment. Proper input validation and output encoding practices, as recommended by OWASP and other security standards, should be implemented to prevent similar vulnerabilities from occurring in future deployments.