CVE-2025-25280

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Buffer overflow vulnerability exists in FutureNet AS series (Industrial Routers) and FA series (Protocol Conversion Machine) provided by Century Systems Co., Ltd. If this vulnerability is exploited, a remote unauthenticated attacker may reboot the device by sending a specially crafted request.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-120

Affected software

VendorProductVersions
Century Systems Co., Ltd.FutureNet AS-250/Sfirmware Version 1.14.0 and earlier
Century Systems Co., Ltd.FutureNet AS-250/F-SCfirmware Version 1.14.0 and earlier
Century Systems Co., Ltd.FutureNet AS-250/F-KOfirmware Version 1.14.0 and earlier
Century Systems Co., Ltd.FutureNet AS-250/NLfirmware Version 1.14.0 and earlier
Century Systems Co., Ltd.FutureNet AS-250/KLfirmware Version 1.14.0 and earlier
Century Systems Co., Ltd.FutureNet AS-250/KL Rev2firmware Version 2.6.6 and earlier
Century Systems Co., Ltd.FutureNet AS-250/Lfirmware Version 2.6.6 and earlier
Century Systems Co., Ltd.FutureNet AS-M250/Lfirmware Version 3.0.0 and earlier
Century Systems Co., Ltd.FutureNet AS-M250/KLfirmware Version 3.0.0 and earlier
Century Systems Co., Ltd.FutureNet AS-M250/NLfirmware Version 3.0.0 and earlier
Century Systems Co., Ltd.FutureNet AS-P250/NLfirmware Version 2.6.6 and earlier
Century Systems Co., Ltd.FutureNet AS-P250/KLfirmware Version 2.6.6 and earlier
Century Systems Co., Ltd.FutureNet AS-210/U4firmware Version 2.6.6 and earlier
Century Systems Co., Ltd.FutureNet FA-210firmware Version 1.1.9 and earlier
Century Systems Co., Ltd.FutureNet FA-215firmware Version 1.0.1 and earlier

References

Timeline

Published
Mar 3, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-252817.5An attacker may modify the URL to discover sensitive information about the target network.CVE-2025-252828.1RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploiCVE-2025-252837.5parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to CVE-2025-252848.7The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS (Web Processing CVE-2025-252855.3@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting CVE-2025-252869.8Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4CVE-2025-252874.7Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus CVE-2025-252885.3@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.CVE-2025-252895.3@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular ExpressCVE-2025-25293.7Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizeCVE-2025-252905.3@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prCVE-2025-252919.8ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found
CVE-2025-25280: Medium severity, CVSS 5.3 | Vulnix