Century Systems FutureNet NXR-G050 up to firmware versions 21.15.7/later but 21.15.8 REST-API incorrect provision of specified functionality

Summaryinfo

A vulnerability was found in Century Systems FutureNet NXR-G110, FutureNet NXR-G060 and FutureNet NXR-G050 up to firmware versions 21.15.7/later but 21.15.8. It has been rated as very critical. This impacts an unknown function of the component REST-API. This manipulation causes incorrect provision of specified functionality. This vulnerability is registered as CVE-2024-50357. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Century Systems FutureNet NXR-G110, FutureNet NXR-G060 and FutureNet NXR-G050 up to firmware versions 21.15.7/later but 21.15.8. It has been declared as very critical. Affected by this vulnerability is an unknown function of the component REST-API. The manipulation with an unknown input leads to a incorrect provision of specified functionality vulnerability. The CWE definition for the vulnerability is CWE-684. The code does not function according to its published specifications, potentially leading to incorrect usage. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs.

The advisory is shared at centurysys.co.jp. This vulnerability is known as CVE-2024-50357 since 10/23/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/29/2024).

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Century Systems

Name

• FutureNet NXR-G050
• FutureNet NXR-G060
• FutureNet NXR-G110

Version

• firmware versions 21.15.0
• firmware versions 21.15.1
• firmware versions 21.15.2
• firmware versions 21.15.3
• firmware versions 21.15.4
• firmware versions 21.15.5
• firmware versions 21.15.6
• firmware versions 21.15.7
• later but 21.15.0
• later but 21.15.1
• later but 21.15.2
• later but 21.15.3
• later but 21.15.4
• later but 21.15.5
• later but 21.15.6
• later but 21.15.7
• later but 21.15.8

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion