CVE-2025-24846

Authentication bypass vulnerability exists in FutureNet AS series (Industrial Routers) provided by Century Systems Co., Ltd. If this vulnerability is exploited, a remote unauthenticated attacker may obtain the device information such as MAC address by sending a specially crafted request.

Score

CVSS 3.1 7.5 High

Status

Deferred - vultures@jpcert.or.jp

Published

2025-03-03

Last modified

2025-03-03

Weaknesses

CWE-288

Affected products

• Futurenet As-210u4 (Century Systems Co. Ltd.)
• Futurenet As-250f-ko (Century Systems Co. Ltd.)
• Futurenet As-250f-sc (Century Systems Co. Ltd.)
• Futurenet As-250kl (Century Systems Co. Ltd.)
• Futurenet As-250kl Rev2 (Century Systems Co. Ltd.)
• Futurenet As-250l (Century Systems Co. Ltd.)
• Futurenet As-250nl (Century Systems Co. Ltd.)
• Futurenet As-250s (Century Systems Co. Ltd.)
• Futurenet As-m250kl (Century Systems Co. Ltd.)
• Futurenet As-m250l (Century Systems Co. Ltd.)
• Futurenet As-m250nl (Century Systems Co. Ltd.)
• Futurenet As-p250kl (Century Systems Co. Ltd.)
• Futurenet As-p250nl (Century Systems Co. Ltd.)

References

• https://jvn.jp/en/vu/JVNVU96398949/
• https://www.centurysys.co.jp/backnumber/common/jvnvu96398949.html