Skip to content
Fencer Vulns
critical 9.8

CVE-2024-50357 json

FutureNet NXR series routers provided by Century Systems Co., Ltd.

published 2024-11-29 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-45180

cvss
9.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs.

Patch / fix

  • centurysys futurenet_nxr-g110_firmware 21.15.9
  • centurysys futurenet_nxr-g060_firmware 21.15.6C1
  • centurysys futurenet_nxr-g050_firmware 21.12.11

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
23 mo ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Century Systems Co., Ltd. FutureNet NXR-G110 series
  • Century Systems Co., Ltd. FutureNet NXR-G060 series
  • Century Systems Co., Ltd. FutureNet NXR-G050 series
  • centurysys futurenet_nxr-g110_firmware
  • centurysys futurenet_nxr-g060_firmware
  • centurysys futurenet_nxr-g050_firmware

Classification

Weakness
  • CWE-684 Incorrect Provision of Specified Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.