OS command injection in Century Systems Co., Ltd. FutureNet NXR-1300 series
Priority MEDIUM 41CWE-489Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user who knows how to use the debug function logs in to the product, the debug function may be used and an arbitrary OS command may be executed.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00619 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Century Systems Co., Ltd. | FutureNet NXR-1300 series | firmware version 7.4.9 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-650 | firmware version 21.16.1 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-610X series | firmware version 21.14.11 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-530 | firmware version 21.11.13 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-350/C | firmware version 5.30.9 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-230/C | firmware version 5.30.12 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-160/LW | firmware version 21.8.3 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-G200 series | firmware version 9.12.15 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-G180/L-CA | firmware version 21.7.28B and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-G120 series | firmware version 21.15.2 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-G110 series | firmware version 21.7.30C and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-G100 series | firmware version 6.23.10 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-G060 series | firmware version 21.15.5 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-G050 series | firmware version 21.12.9 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet VXR/x64 | firmware version 21.7.31 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet VXR/x86 | firmware version 10.1.4 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-1200 | firmware version 5.25.21 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-130/C | firmware version 5.13.21 and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-155/C series | firmware version 5.22.5M and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-125/CX | firmware version 5.25.7H and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet NXR-120/C | firmware version 5.25.7H and earlier | — | No fix listed | CNA |
| Century Systems Co., Ltd. | FutureNet WXR-250 | firmware version 1.4.7 and earlier | — | No fix listed | CNA |
- FutureNet NXR-1300 series VendorCentury Systems Co., Ltd. Affected firmware version 7.4.9 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-650 VendorCentury Systems Co., Ltd. Affected firmware version 21.16.1 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-610X series VendorCentury Systems Co., Ltd. Affected firmware version 21.14.11 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-530 VendorCentury Systems Co., Ltd. Affected firmware version 21.11.13 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-350/C VendorCentury Systems Co., Ltd. Affected firmware version 5.30.9 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-230/C VendorCentury Systems Co., Ltd. Affected firmware version 5.30.12 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-160/LW VendorCentury Systems Co., Ltd. Affected firmware version 21.8.3 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-G200 series VendorCentury Systems Co., Ltd. Affected firmware version 9.12.15 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-G180/L-CA VendorCentury Systems Co., Ltd. Affected firmware version 21.7.28B and earlier Fixed in — No fix listed CNA
- FutureNet NXR-G120 series VendorCentury Systems Co., Ltd. Affected firmware version 21.15.2 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-G110 series VendorCentury Systems Co., Ltd. Affected firmware version 21.7.30C and earlier Fixed in — No fix listed CNA
- FutureNet NXR-G100 series VendorCentury Systems Co., Ltd. Affected firmware version 6.23.10 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-G060 series VendorCentury Systems Co., Ltd. Affected firmware version 21.15.5 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-G050 series VendorCentury Systems Co., Ltd. Affected firmware version 21.12.9 and earlier Fixed in — No fix listed CNA
- FutureNet VXR/x64 VendorCentury Systems Co., Ltd. Affected firmware version 21.7.31 and earlier Fixed in — No fix listed CNA
- FutureNet VXR/x86 VendorCentury Systems Co., Ltd. Affected firmware version 10.1.4 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-1200 VendorCentury Systems Co., Ltd. Affected firmware version 5.25.21 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-130/C VendorCentury Systems Co., Ltd. Affected firmware version 5.13.21 and earlier Fixed in — No fix listed CNA
- FutureNet NXR-155/C series VendorCentury Systems Co., Ltd. Affected firmware version 5.22.5M and earlier Fixed in — No fix listed CNA
- FutureNet NXR-125/CX VendorCentury Systems Co., Ltd. Affected firmware version 5.25.7H and earlier Fixed in — No fix listed CNA
- FutureNet NXR-120/C VendorCentury Systems Co., Ltd. Affected firmware version 5.25.7H and earlier Fixed in — No fix listed CNA
- FutureNet WXR-250 VendorCentury Systems Co., Ltd. Affected firmware version 1.4.7 and earlier Fixed in — No fix listed CNA
CPE configurations NVD · 33
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:centurysys:futurenet_nxr-1300_firmware:*:*:*:*:*:*:*:* | before 7.4.10 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-155\/c_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-610x_firmware:*:*:*:*:*:*:*:* | before 21.14.11c | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-g050_firmware:*:*:*:*:*:*:*:* | before 21.12.10 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-g060_firmware:*:*:*:*:*:*:*:* | before 21.15.6 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-g100_firmware:*:*:*:*:*:*:*:* | before 6.23.11 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-g110_firmware:*:*:*:*:*:*:*:* | before 21.7.32 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-g120_firmware:*:*:*:*:*:*:*:* | before 21.15.2c | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-g200_firmware:*:*:*:*:*:*:*:* | before 9.12.16 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_vxr-x64:*:*:*:*:*:*:*:* | before 21.7.32 | Vulnerable | Century Systems Co., Ltd. |
- cpe:2.3:o:centurysys:futurenet_nxr-1300_firmware:*:*:*:*:*:*:*:* Versions before 7.4.10 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-155\/c_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-610x_firmware:*:*:*:*:*:*:*:* Versions before 21.14.11c Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-g050_firmware:*:*:*:*:*:*:*:* Versions before 21.12.10 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-g060_firmware:*:*:*:*:*:*:*:* Versions before 21.15.6 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-g100_firmware:*:*:*:*:*:*:*:* Versions before 6.23.11 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-g110_firmware:*:*:*:*:*:*:*:* Versions before 21.7.32 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-g120_firmware:*:*:*:*:*:*:*:* Versions before 21.15.2c Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-g200_firmware:*:*:*:*:*:*:*:* Versions before 9.12.16 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_vxr-x64:*:*:*:*:*:*:*:* Versions before 21.7.32 Vulnerable ·Century Systems Co., Ltd.
Show 23 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:centurysys:futurenet_vxr-x86:*:*:*:*:*:*:*:* | before 10.1.5 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-160\/lw_firmware:*:*:*:*:*:*:*:* | before 21.8.4 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_nxr-160\/lw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-230\/c_firmware:*:*:*:*:*:*:*:* | before 5.30.13 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_nxr-230\/c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-350\/c_firmware:*:*:*:*:*:*:*:* | before 5.30.9c | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_nxr-350\/c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-530_firmware:*:*:*:*:*:*:*:* | before 21.11.14 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_nxr-530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-650_firmware:*:*:*:*:*:*:*:* | before 21.16.2 | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_nxr-650:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-g180\/l-ca_firmware:*:*:*:*:*:*:*:* | before 21.7.28c | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_nxr-g180\/l-ca:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-130\/c_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_nxr-130\/c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-125\/cx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_nxr-125\/cx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-120\/c_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_nxr-120\/c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_wxr-250_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_wxr-250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
| cpe:2.3:o:centurysys:futurenet_nxr-1200_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Century Systems Co., Ltd. |
| cpe:2.3:h:centurysys:futurenet_nxr-1200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Century Systems Co., Ltd. |
- cpe:2.3:o:centurysys:futurenet_vxr-x86:*:*:*:*:*:*:*:* Versions before 10.1.5 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-160\/lw_firmware:*:*:*:*:*:*:*:* Versions before 21.8.4 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_nxr-160\/lw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-230\/c_firmware:*:*:*:*:*:*:*:* Versions before 5.30.13 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_nxr-230\/c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-350\/c_firmware:*:*:*:*:*:*:*:* Versions before 5.30.9c Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_nxr-350\/c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-530_firmware:*:*:*:*:*:*:*:* Versions before 21.11.14 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_nxr-530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-650_firmware:*:*:*:*:*:*:*:* Versions before 21.16.2 Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_nxr-650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-g180\/l-ca_firmware:*:*:*:*:*:*:*:* Versions before 21.7.28c Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_nxr-g180\/l-ca:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-130\/c_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_nxr-130\/c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-125\/cx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_nxr-125\/cx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-120\/c_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_nxr-120\/c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_wxr-250_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_wxr-250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
- cpe:2.3:o:centurysys:futurenet_nxr-1200_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Century Systems Co., Ltd.
- cpe:2.3:h:centurysys:futurenet_nxr-1200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Century Systems Co., Ltd.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-36475
- 2026-10-03 Alias added: GHSA-hx98-fgmp-472p
References
More Century Systems Co., Ltd. Futurenet Nxr-1200 Firmware vulnerabilities
- TI-2024-24267 OS command injection in Century Systems Co., Ltd. FutureNet NXR-1300 series CVSS 3.1CRITICAL 9.8
- TI-2024-20461 Initialization of a resource with an insecure default vulnerability in FutureNet NXR… CVSS 3.1CRITICAL 9.1
Sources
- CVE-2024-36475 · CVE Program
- CVE-2024-36475 · NVD
- FIRST EPSS
- GHSA-hx98-fgmp-472p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences