CVE-2024-31070

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allows a remote unauthenticated attacker to access telnet service unlimitedly.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-1188

Affected software

VendorProductVersions
Century Systems Co., Ltd.FutureNet NXR-1300 seriesfirmware version 7.4.9 and earlier
Century Systems Co., Ltd.FutureNet NXR-650firmware version 21.16.1 and earlier
Century Systems Co., Ltd.FutureNet NXR-610X seriesfirmware version 21.14.11 and earlier
Century Systems Co., Ltd.FutureNet NXR-530firmware version 21.11.13 and earlier
Century Systems Co., Ltd.FutureNet NXR-350/Cfirmware version 5.30.9 and earlier
Century Systems Co., Ltd.FutureNet NXR-230/Cfirmware version 5.30.12 and earlier
Century Systems Co., Ltd.FutureNet NXR-160/LWfirmware version 21.8.3 and earlier
Century Systems Co., Ltd.FutureNet NXR-G200 seriesfirmware version 9.12.15 and earlier
Century Systems Co., Ltd.FutureNet NXR-G180/L-CAfirmware version 21.7.28B and earlier
Century Systems Co., Ltd.FutureNet NXR-G120 seriesfirmware version 21.15.2 and earlier
Century Systems Co., Ltd.FutureNet NXR-G110 seriesfirmware version 21.7.30C and earlier
Century Systems Co., Ltd.FutureNet NXR-G100 seriesfirmware version 6.23.10 and earlier
Century Systems Co., Ltd.FutureNet NXR-G060 seriesfirmware version 21.15.5 and earlier
Century Systems Co., Ltd.FutureNet NXR-G050 seriesfirmware version 21.12.9 and earlier
Century Systems Co., Ltd.FutureNet VXR/x64firmware version 21.7.31 and earlier
Century Systems Co., Ltd.FutureNet VXR/x86firmware version 10.1.4 and earlier
Century Systems Co., Ltd.FutureNet NXR-1200firmware version 5.25.21 and earlier
Century Systems Co., Ltd.FutureNet NXR-130/Cfirmware version 5.13.21 and earlier
Century Systems Co., Ltd.FutureNet NXR-155/C seriesfirmware version 5.22.5M and earlier
Century Systems Co., Ltd.FutureNet NXR-125/CXfirmware version 5.25.7H and earlier
Century Systems Co., Ltd.FutureNet NXR-120/Cfirmware version 5.25.7H and earlier
Century Systems Co., Ltd.FutureNet WXR-250firmware version 1.4.7 and earlier
centurysysfuturenet_nxr-1300_firmware<= 7.4.9
centurysysfuturenet_nxr-650_firmware<= 21.16.1
centurysysfuturenet_nxr-610x_firmware<= 21.14.11
centurysysfuturenet_nxr-530_firmware<= 21.11.13
centurysysfuturenet_nxr-350\/c_firmware<= 5.30.9
centurysysfuturenet_nxr-230\/c_firmware<= 5.30.12
centurysysfuturenet_nxr-160\/lw_firmware<= 21.8.3
centurysysfuturenet_nxr-g200_firmware<= 9.12.15
centurysysfuturenet_nxr-g180\/l-ca_firmware<= 21.7.28B
centurysysfuturenet_nxr-g120_firmware<= 21.15.2
centurysysfuturenet_nxr-g110_firmware<= 21.7.30C
centurysysfuturenet_nxr-g100_firmware<= 6.23.10
centurysysfuturenet_nxr-g060_firmware<= 21.15.5
centurysysfuturenet_nxr-g050_firmware<= 21.12.9
centurysysfuturenet_vxr\/x64_firmware<= 21.7.31
centurysysfuturenet_vxr\/x86_firmware<= 10.1.4
centurysysfuturenet_nxr-1200_firmware<= 5.25.21
centurysysfuturenet_nxr-130\/c_firmware<= 5.13.21
centurysysfuturenet_nxr-155\/c_firmware<= 5.22.5M
centurysysfuturenet_nxr-125\/cx_firmware<= 5.25.7H
centurysysfuturenet_nxr-120\/c_firmware<= 5.25.7H
centurysysfuturenet_wxr-250_firmware<= 1.4.7

References

Timeline

Published
Jul 17, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-310713.3in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion.CVE-2024-310736.7Uncontrolled search path for some Intel(R) oneAPI Level Zero software may allow an authenticated user to potentially enable escalation of prCVE-2024-310745.9Observable timing discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via neCVE-2024-310765.5In the Linux kernel, the following vulnerability has been resolved: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline CVE-2024-310777.2Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with CVE-2024-310785.5in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through NULL pointer dereference.CVE-2024-310794.8When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to tCVE-2024-31085.5An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquireCVE-2024-310807.3A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-CVE-2024-310817.3A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-CVE-2024-310827.3A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byteCVE-2024-310837.8A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is ca
CVE-2024-31070: Critical severity, CVSS 9.1 | Vulnix