CVE-2024-50357

published 2024-11-29

CVE-2024-50357: FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default)…

Priority P2 61 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
century_systems_co_ltd	futurenet_nxr-g050_series	—	—
century_systems_co_ltd	futurenet_nxr-g060_series	—	—
century_systems_co_ltd	futurenet_nxr-g110_series	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-684