CVE-2024-50357: Century Systems Co., Ltd. FutureNet NXR-G110 series

Описание

Оригинално описание

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs.

Засегнати продукти

• Century Systems Co., Ltd. FutureNet NXR-G110 series: firmware versions 21.15.7 and later but prior to 21.15.9
• Century Systems Co., Ltd. FutureNet NXR-G060 series: firmware versions prior to 21.15.6C1
• Century Systems Co., Ltd. FutureNet NXR-G050 series: firmware versions 21.12.5 and later but prior to 21.12.11
• centurysys: още 3 продукта, добавени от centurysys

  futurenet_nxr-g110_firmware, futurenet_nxr-g060_firmware, futurenet_nxr-g050_firmware

Вид слабост

• CWE-684 Incorrect Provision of Specified Functionality

История

Други уязвимости в Century Systems Co., Ltd. FutureNet NXR-G110 series

• 6.2CVE-2025-30485
• 9.8CVE-2024-36491
• 7.2CVE-2024-36475
• 9.1CVE-2024-31070

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-50357
• https://nvd.nist.gov/vuln/detail/CVE-2024-50357
• https://www.centurysys.co.jp/backnumber/nxr_common/20241031-01.html
• https://jvn.jp/en/vu/JVNVU95001899/