CVE-2025-30485

UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected product an external storage containing malicious symbolic link files, a logged-in administrative user may obtain and/or destroy internal files.

Score

CVSS 3.0 6.2 Medium

Status

Deferred - vultures@jpcert.or.jp

Published

2025-04-03

Last modified

2025-04-03

Weaknesses

CWE-61

Affected products

• Futurenet Nxr-1200 (Century Systems Co. Ltd.)
• Futurenet Nxr-120c (Century Systems Co. Ltd.)
• Futurenet Nxr-125cx (Century Systems Co. Ltd.)
• Futurenet Nxr-1300 Series (Century Systems Co. Ltd.)
• Futurenet Nxr-130c (Century Systems Co. Ltd.)
• Futurenet Nxr-1420 (Century Systems Co. Ltd.)
• Futurenet Nxr-155c-l (Century Systems Co. Ltd.)
• Futurenet Nxr-155c-wm (Century Systems Co. Ltd.)
• Futurenet Nxr-155c-xw (Century Systems Co. Ltd.)
• Futurenet Nxr-160lw (Century Systems Co. Ltd.)
• Futurenet Nxr-230c (Century Systems Co. Ltd.)
• Futurenet Nxr-350c (Century Systems Co. Ltd.)
• Futurenet Nxr-530 (Century Systems Co. Ltd.)
• Futurenet Nxr-610x Series (Century Systems Co. Ltd.)
• Futurenet Nxr-650 (Century Systems Co. Ltd.)
• Futurenet Nxr-g050 Series (Century Systems Co. Ltd.)
• Futurenet Nxr-g060 Series (Century Systems Co. Ltd.)
• Futurenet Nxr-g100 Series (Century Systems Co. Ltd.)
• Futurenet Nxr-g100f (Century Systems Co. Ltd.)
• Futurenet Nxr-g100n (Century Systems Co. Ltd.)
• Futurenet Nxr-g100s (Century Systems Co. Ltd.)
• Futurenet Nxr-g100sl (Century Systems Co. Ltd.)
• Futurenet Nxr-g100slw (Century Systems Co. Ltd.)
• Futurenet Nxr-g110 Series (Century Systems Co. Ltd.)
• Futurenet Nxr-g120 Series (Century Systems Co. Ltd.)
• Futurenet Nxr-g180l-ca (Century Systems Co. Ltd.)
• Futurenet Nxr-g240 Series (Century Systems Co. Ltd.)
• Futurenet Nxr-g260 Series (Century Systems Co. Ltd.)
• Futurenet Nxr-g540 Series (Century Systems Co. Ltd.)
• Futurenet Vxr-x64 (Century Systems Co. Ltd.)
• Futurenet Vxr-x86 (Century Systems Co. Ltd.)
• Futurenet Wxr-250 (Century Systems Co. Ltd.)

References

• https://jvn.jp/en/vu/JVNVU92821536/
• https://www.centurysys.co.jp/backnumber/common/jvnvu92821536.html