CVE-2024-31070
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to access telnet services without restrictions on affected Century Systems devices. It affects FutureNet NXR, VXR, and WXR series devices with insecure default configurations. Attackers can gain unauthorized access to network equipment.
💻 Affected Systems
- FutureNet NXR series
- FutureNet VXR series
- FutureNet WXR series
📦 What is this software?
Futurenet Nxr 125\/cx Firmware by Centurysys
Futurenet Nxr 160\/lw Firmware by Centurysys
Futurenet Nxr G180\/l Ca Firmware by Centurysys
Futurenet Vxr X64 by Centurysys
Futurenet Vxr X86 by Centurysys
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of network devices leading to network disruption, data interception, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Unauthorized access to telnet services allowing configuration changes, network reconnaissance, and potential credential harvesting.
If Mitigated
Limited impact if telnet is disabled, network segmentation is implemented, and access controls are properly configured.
🎯 Exploit Status
Exploitation requires only telnet access to vulnerable devices. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates released July 2024
Vendor Advisory: https://www.centurysys.co.jp/backnumber/nxr_common/20240716-01.html
Restart Required: Yes
Instructions:
1. Download latest firmware from Century Systems website. 2. Backup current configuration. 3. Apply firmware update via web interface or console. 4. Reboot device. 5. Verify telnet is disabled or properly secured.
🔧 Temporary Workarounds
Disable Telnet Service
allCompletely disable telnet service on affected devices
telnet disable
no telnet server enable
Restrict Telnet Access
allConfigure access control lists to restrict telnet access to trusted IPs only
access-list 10 permit 192.168.1.0 0.0.0.255
line vty 0 4
access-class 10 in
🧯 If You Can't Patch
- Implement network segmentation to isolate affected devices from untrusted networks
- Deploy network-based access controls to block telnet traffic (TCP port 23) to vulnerable devices
🔍 How to Verify
Check if Vulnerable:
Attempt telnet connection to device on port 23. If connection succeeds without authentication, device is vulnerable.Check Version:
show version or display version in device CLIVerify Fix Applied:
Attempt telnet connection after patch. Connection should fail or require proper authentication.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts on telnet
- Successful telnet connections from unexpected sources
- Configuration changes via telnet
Network Indicators:
- Telnet traffic (TCP/23) to affected devices
- Unencrypted telnet sessions
SIEM Query:
source_port=23 OR destination_port=23 AND (device_type="FutureNet" OR device_vendor="Century Systems")🔗 References
- https://jvn.jp/en/vu/JVNVU96424864/
- https://www.centurysys.co.jp/backnumber/nxr_common/20240716-01.html
- https://www.centurysys.co.jp/backnumber/nxr_common/20240716-03.html
- https://jvn.jp/en/vu/JVNVU96424864/
- https://www.centurysys.co.jp/backnumber/nxr_common/20240716-01.html
- https://www.centurysys.co.jp/backnumber/nxr_common/20240716-03.html
