Riskcovery

CVE-2024-50357

State
Published
Severity
9.8 Critical
Published
Nov 29, 2024
Updated
Dec 2, 2024
Reserved
Oct 23, 2024

Read the record on cve.org

Description

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs.

Scores

CVSSScoreVectorSource
3.09.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hjpcert

Weaknesses

  • CWE-684 Incorrect provision of specified functionality

Affected Products

ProductVersions
FutureNet NXR-G110 seriesCentury Systems Co., Ltd.
  • firmware versions 21.15.7 and later but prior to 21.15.9Affected
FutureNet NXR-G060 seriesCentury Systems Co., Ltd.
  • firmware versions prior to 21.15.6C1Affected
FutureNet NXR-G050 seriesCentury Systems Co., Ltd.
  • firmware versions 21.12.5 and later but prior to 21.12.11Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.