by Kastro
Paper/Archive/CVE-2024-31070

CVE-2024-31070

Century Systems Co., Ltd. FutureNet NXR-1300 series — Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Centur…

EPSS 0.8%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 55.0.550 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allows a remote unauthenticated attacker to access telnet service unlimitedly.

Affected

ProductAffectedFixed inSource
FutureNet NXR-1300 seriesfirmware version 7.4.9 and earlier–CNA
FutureNet NXR-650firmware version 21.16.1 and earlier–CNA
FutureNet NXR-610X seriesfirmware version 21.14.11 and earlier–CNA
FutureNet NXR-530firmware version 21.11.13 and earlier–CNA
FutureNet NXR-350/Cfirmware version 5.30.9 and earlier–CNA
FutureNet NXR-230/Cfirmware version 5.30.12 and earlier–CNA
FutureNet NXR-160/LWfirmware version 21.8.3 and earlier–CNA
FutureNet NXR-G200 seriesfirmware version 9.12.15 and earlier–CNA
FutureNet NXR-G180/L-CAfirmware version 21.7.28B and earlier–CNA
FutureNet NXR-G120 seriesfirmware version 21.15.2 and earlier–CNA
FutureNet NXR-G110 seriesfirmware version 21.7.30C and earlier–CNA
FutureNet NXR-G100 seriesfirmware version 6.23.10 and earlier–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcenturysys.co.jp/backnumber/nxr_common/20240716-01.htmlrefcenturysys.co.jp/backnumber/nxr_common/20240716-03.htmlrefjvn.jp/en/vu/JVNVU96424864