CRITICAL🇵🇱 Wersja polska

CVE-2024-31070

CVSS 9.1v3.1pub. 2024-07-17upd. 2024-11-21

Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allows a remote unauthenticated attacker to access telnet service unlimitedly.

🤖 AI Analysis
How it works

The vulnerability results from the use of insecure default settings during resource initialization (CWE-1188). The Telnet service on the device does not require authentication or its access control mechanism is configured to allow unrestricted connections. A remote, unauthenticated attacker can connect to the Telnet service over the network without providing any login credentials, completely bypassing authentication mechanisms.

Impact

Attackers gain unrestricted access to the device's Telnet service, which can lead to takeover of network device configuration control and disclosure of confidential configuration data. This can result in violation of confidentiality and availability of the entire network infrastructure served by the device.

Mitigation & patch

Security patches available from the manufacturer should be applied in accordance with references (published 2024-07-16 on Century Systems website). Additionally, it is recommended to immediately disable or restrict access to the Telnet service at the firewall level and replace Telnet with SSH protocol where possible.

Who is affected

Firmware of Century Systems FutureNet NXR-1300, NXR-155/C, NXR-610X, NXR-G050, NXR-G060 devices and other NXR, VXR, and WXR series devices — specific firmware versions indicated in manufacturer references.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

  • Centurysys Futurenet Nxr 1200

    HW
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 1200 Firmware

    OS
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 120\/c

    HW
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 120\/c Firmware

    OS
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 125\/cx Firmware

    OS
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 1300 Firmware

    OS
    Centurysys
    < 7.4.10

  • Centurysys Futurenet Nxr 130\/c

    HW
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 130\/c Firmware

    OS
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 155\/c Firmware

    OS
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 160\/lw

    HW
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 160\/lw Firmware

    OS
    Centurysys
    < 21.8.4

  • Centurysys Futurenet Nxr 230\/c

    HW
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 230\/c Firmware

    OS
    Centurysys
    < 5.30.13

  • Centurysys Futurenet Nxr 350\/c

    HW
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 350\/c Firmware

    OS
    Centurysys
    < 5.30.9c

  • Centurysys Futurenet Nxr 530

    HW
    Centurysys
    all versions

  • Centurysys Futurenet Nxr 530 Firmware

    OS
    Centurysys
    < 21.11.14

  • Centurysys Futurenet Nxr 610x Firmware

    OS
    Centurysys
    < 21.14.11c

  • Centurysys Futurenet Nxr 650 Firmware

    OS
    Centurysys
    < 21.16.2

  • Centurysys Futurenet Nxr G050 Firmware

    OS
    Centurysys
    < 21.12.10

  • Centurysys Futurenet Nxr G060 Firmware

    OS
    Centurysys
    < 21.15.6

  • Centurysys Futurenet Nxr G100 Firmware

    OS
    Centurysys
    < 6.23.11

  • Centurysys Futurenet Nxr G110 Firmware

    OS
    Centurysys
    < 21.7.32

  • Centurysys Futurenet Nxr G120 Firmware

    OS
    Centurysys
    < 21.15.2c

  • Centurysys Futurenet Nxr G180\/l Ca

    HW
    Centurysys
    all versions

  • Centurysys Futurenet Nxr G180\/l Ca Firmware

    OS
    Centurysys
    < 21.7.28c

  • Centurysys Futurenet Nxr G200 Firmware

    OS
    Centurysys
    < 9.12.16

  • Centurysys Futurenet Vxr X64

    OS
    Centurysys
    < 21.7.32

  • Centurysys Futurenet Vxr X86

    OS
    Centurysys
    < 10.1.5

  • Centurysys Futurenet Wxr 250

    HW
    Centurysys
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2024-36491CRITICAL9.8PL ✓same product

Command Injection w urządzeniach FutureNet NXR/VXR/WXR (Century Systems)

CVE-2024-36475HIGH8.8same product

FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug ...

CVE-2008-6449MEDIUM4.0same vendor

Cross-site request forgery (CSRF) vulnerability in multiple Century Systems routers including XR-410 before 1....