CVE-2024-50357

In the factory configuration, REST-API is marked as disabled, however after the device is started with an active HTTP server (GUI) or Web authentication function, REST-API is unexpectedly enabled. The factory configuration by default launches the HTTP server, which causes the described problem to affect virtually every device with standard settings. The REST-API authentication credentials (username and password) are pre-configured in the factory settings and are therefore identical for all devices supplied by the manufacturer. An attacker can remotely, without any authentication (using default credentials), send requests to the REST-API over the network.

An attacker can remotely read and modify the device configuration via REST-API, which may result in taking full control of the router, changing network settings, redirecting traffic, or permanent loss of device integrity.

Apply patches available from the manufacturer in accordance with the references (https://www.centurysys.co.jp/backnumber/nxr_common/20241031-01.html). Until the update is applied, it is recommended to disable the HTTP server (GUI) and Web authentication functions if not required, and to restrict access to the device management interface at the firewall level or through network segmentation.

FutureNet NXR series routers from Century Systems Co., Ltd.; specific firmware versions and models indicated in the manufacturer's references