CVE-2024-50357: Century Systems Co., Ltd Futurenet Nxr-g050 Series

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs.

Affected products

• Century Systems Co., Ltd Futurenet Nxr-g050 Series
• Century Systems Co., Ltd Futurenet Nxr-g060 Series
• Century Systems Co., Ltd Futurenet Nxr-g110 Series
• Centurysys Futurenet Nxr-g050 Firmware: from 21.12.5, before 21.12.11 (fixed in 21.12.11)
• Centurysys Futurenet Nxr-g060 Firmware: before 21.15.6C1 (fixed in 21.15.6C1)
• Centurysys Futurenet Nxr-g110 Firmware: from 21.15.7, before 21.15.9 (fixed in 21.15.9)

Published 2024-11-29. Last modified 2026-06-17.