CVE-2024-50357 | THREATINT

Description

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs.

Reserved 2024-10-23 | Published 2024-11-29 | Updated 2024-12-02 | Assigner jpcert

CRITICAL: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Incorrect provision of specified functionality

Product status

firmware versions 21.15.7 and later but prior to 21.15.9

affected

firmware versions prior to 21.15.6C1

affected

firmware versions 21.12.5 and later but prior to 21.12.11

affected

References

www.centurysys.co.jp/backnumber/nxr_common/20241031-01.html

jvn.jp/en/vu/JVNVU95001899/

cve.org (CVE-2024-50357)

nvd.nist.gov (CVE-2024-50357)

Download JSON