Cyber Resilience

CVE-2024-31070

Critical

Published: 17 July 2024

Published
17 July 2024
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS Score 0.0207 84.3th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-31070 is a critical-severity Initialization of a Resource with an Insecure Default (CWE-1188) vulnerability in Centurysys Futurenet Nxr-650 Firmware. Its CVSS base score is 9.1 (Critical).

Operationally, ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allows a remote unauthenticated attacker to access telnet service unlimitedly.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

centurysys
futurenet nxr-1300 firmware
≤ 7.4.10
centurysys
futurenet nxr-155\/c firmware
all versions
centurysys
futurenet nxr-610x firmware
≤ 21.14.11c
centurysys
futurenet nxr-g050 firmware
≤ 21.12.10
centurysys
futurenet nxr-g060 firmware
≤ 21.15.6
centurysys
futurenet nxr-g100 firmware
≤ 6.23.11
centurysys
futurenet nxr-g110 firmware
≤ 21.7.32
centurysys
futurenet nxr-g120 firmware
≤ 21.15.2c
centurysys
futurenet nxr-g200 firmware
≤ 9.12.16
centurysys
futurenet vxr-x64
≤ 21.7.32
+12 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-1188

Requires documented secure initialization practices and avoidance of insecure defaults in configuration baselines.

addresses: CWE-1188

Reviewing and updating baseline when components are installed or upgraded prevents initialization with insecure defaults.

addresses: CWE-1188

Requiring explicit configuration to minimal functionality overrides insecure defaults that would otherwise enable excess capabilities.

addresses: CWE-1188

Tailoring replaces or augments insecure default initializations with system-specific values and compensating controls before deployment.

addresses: CWE-1188

Central configuration overrides or replaces insecure default initializations that would otherwise be left unchanged on each system.

addresses: CWE-1188

SCRM practices during acquisition and configuration management address insecure default initializations shipped by vendors.

addresses: CWE-1188

Scans detect resources initialized with insecure defaults that create exploitable conditions.

addresses: CWE-1188

Instruction on secure initialization of security controls prevents leaving resources with insecure defaults after installation.

References