CVE-2025-30485

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected product an external storage containing malicious symbolic link files, a logged-in administrative user may obtain and/or destroy internal files.

Metrics

CVSS 3.0 6.2/10CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-61

Affected software

VendorProductVersions
Century Systems Co., Ltd.FutureNet NXR-1420firmware version 31.0.1 and earlier
Century Systems Co., Ltd.FutureNet NXR-1300 seriesfirmware version 7.4.12 and earlier
Century Systems Co., Ltd.FutureNet NXR-650firmware version 21.16.5 and earlier
Century Systems Co., Ltd.FutureNet NXR-610X seriesfirmware version 21.14.11D and earlier
Century Systems Co., Ltd.FutureNet NXR-530firmware version 21.11.15 and earlier
Century Systems Co., Ltd.FutureNet NXR-350/Cfirmware version 5.30.9C and earlier
Century Systems Co., Ltd.FutureNet NXR-230/Cfirmware version 5.30.13 and earlier
Century Systems Co., Ltd.FutureNet NXR-160/LWfirmware version 21.8.4 and earlier
Century Systems Co., Ltd.FutureNet NXR-G540 seriesfirmware version 21.17.0
Century Systems Co., Ltd.FutureNet NXR-G260 seriesfirmware version 9.12.17 and earlier
Century Systems Co., Ltd.FutureNet NXR-G240 seriesfirmware version 9.12.17 and earlier
Century Systems Co., Ltd.FutureNet NXR-G180/L-CAfirmware version 21.7.33 and earlier
Century Systems Co., Ltd.FutureNet NXR-G120 seriesfirmware version 21.15.2C1 and earlier
Century Systems Co., Ltd.FutureNet NXR-G110 seriesfirmware version 21.15.10 and earlier
Century Systems Co., Ltd.FutureNet NXR-G100 seriesfirmware version 6.23.11 and earlier
Century Systems Co., Ltd.FutureNet NXR-G060 seriesfirmware version 21.15.6C2 and earlier
Century Systems Co., Ltd.FutureNet NXR-G050 seriesfirmware version 21.12.11 and earlier
Century Systems Co., Ltd.FutureNet VXR-x64firmware version 21.7.33 and earlier
Century Systems Co., Ltd.FutureNet VXR-x86firmware version 10.1.5 and earlier
Century Systems Co., Ltd.FutureNet NXR-1200N/A
Century Systems Co., Ltd.FutureNet NXR-130/CN/A
Century Systems Co., Ltd.FutureNet NXR-155/C-LN/A
Century Systems Co., Ltd.FutureNet NXR-155/C-XWN/A
Century Systems Co., Ltd.FutureNet NXR-155/C-WMN/A
Century Systems Co., Ltd.FutureNet NXR-125/CXN/A
Century Systems Co., Ltd.FutureNet NXR-120/CN/A
Century Systems Co., Ltd.FutureNet NXR-G100/SLWN/A
Century Systems Co., Ltd.FutureNet NXR-G100/SLN/A
Century Systems Co., Ltd.FutureNet NXR-G100/SN/A
Century Systems Co., Ltd.FutureNet NXR-G100/NN/A
Century Systems Co., Ltd.FutureNet NXR-G100/FN/A
Century Systems Co., Ltd.FutureNet WXR-250N/A

References

Timeline

Published
Apr 3, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-30506.5IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticatCVE-2025-305066.7Uncontrolled search path for some Intel Driver and Support Assistant before version 25.2 within Ring 3: User Applications may allow an escalCVE-2025-305077.5CyberData 011209 Intercom could allow an unauthenticated user to gather sensitive information through blind SQL injections.CVE-2025-305086.5Improper authorization in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow a denial of serviCVE-2025-305093.3Improper input validation for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an CVE-2025-30516.5Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-12CVE-2025-305109.8An attacker can upload an arbitrary file instead of a plant image.CVE-2025-305115.4An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plantCVE-2025-305126.5Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).CVE-2025-305137.9Race condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privilegCVE-2025-305145.3Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").CVE-2025-305158.8CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.
CVE-2025-30485: Medium severity, CVSS 6.2 | Vulnix