CVE-2024-31070 Misconfiguration in FutureNet NXR-120/C
Remote unauthenticated attackers can access the telnet service due to insecure default initialization, potentially leading to full device compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-31070?
CVE-2024-31070 is a critical vulnerability in Century Systems Co., Ltd. FutureNet NXR-120/C, published on 17 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allows a remote unauthenticated attacker to access telnet service unlimitedly.
Weakness: CWE-1188
Which versions are affected by CVE-2024-31070?
It affects 22 products.
Products include Centurysys Futurenet Nxr-1200 Firmware, Centurysys Futurenet Nxr-120\/C Firmware, Centurysys Futurenet Nxr-125\/Cx Firmware, Centurysys Futurenet Nxr-1300 Firmware, Centurysys Futurenet Nxr-130\/C Firmware, Centurysys Futurenet Nxr-155\/C Firmware and 16 more.
How do I fix CVE-2024-31070?
No fix has been published for CVE-2024-31070 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-31070 being exploited?
There is no known exploitation of CVE-2024-31070 in the wild and no public exploit code.
Other vulnerabilities in Century Systems Co., Ltd. FutureNet NXR-120/C
Sources
Also known as GHSA-grwm-7vmp-5mcp.