What’s Vulnerable › Vulnerabilities

CVE-2024-36475

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-17 · updated 2026-06-17
• Weakness: CWE-78

Description

FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user who knows how to use the debug function logs in to the product, the debug function may be used and an arbitrary OS command may be executed.

Affected products

• Centurysys Futurenet Nxr-120/C Firmware: all versions
• Centurysys Futurenet Nxr-1200 Firmware: all versions
• Centurysys Futurenet Nxr-125/Cx Firmware: all versions
• Centurysys Futurenet Nxr-130/C Firmware: all versions
• Centurysys Futurenet Nxr-1300 Firmware: before 7.4.10 — fixed in 7.4.10
• Centurysys Futurenet Nxr-155/C Firmware: all versions
• Centurysys Futurenet Nxr-160/Lw Firmware: before 21.8.4 — fixed in 21.8.4
• Centurysys Futurenet Nxr-230/C Firmware: before 5.30.13 — fixed in 5.30.13
• Centurysys Futurenet Nxr-350/C Firmware: before 5.30.9c — fixed in 5.30.9c
• Centurysys Futurenet Nxr-530 Firmware: before 21.11.14 — fixed in 21.11.14
• Centurysys Futurenet Nxr-610X Firmware: before 21.14.11c — fixed in 21.14.11c
• Centurysys Futurenet Nxr-650 Firmware: before 21.16.2 — fixed in 21.16.2
• Centurysys Futurenet Nxr-G050 Firmware: before 21.12.10 — fixed in 21.12.10
• Centurysys Futurenet Nxr-G060 Firmware: before 21.15.6 — fixed in 21.15.6
• Centurysys Futurenet Nxr-G100 Firmware: before 6.23.11 — fixed in 6.23.11
• Centurysys Futurenet Nxr-G110 Firmware: before 21.7.32 — fixed in 21.7.32
• Centurysys Futurenet Nxr-G120 Firmware: before 21.15.2c — fixed in 21.15.2c
• Centurysys Futurenet Nxr-G180/L-Ca Firmware: before 21.7.28c — fixed in 21.7.28c
• Centurysys Futurenet Nxr-G200 Firmware: before 9.12.16 — fixed in 9.12.16
• Century Systems Co., Ltd. FutureNet VXR-x64: before 21.7.32 — fixed in 21.7.32
• Century Systems Co., Ltd. FutureNet VXR-x86: before 10.1.5 — fixed in 10.1.5
• Centurysys Futurenet Wxr-250 Firmware: all versions

How to fix

Upgrade to a fixed version: Centurysys Futurenet Nxr-1300 Firmware 7.4.10; Centurysys Futurenet Nxr-160/Lw Firmware 21.8.4; Centurysys Futurenet Nxr-230/C Firmware 5.30.13; Centurysys Futurenet Nxr-350/C Firmware 5.30.9c; Centurysys Futurenet Nxr-530 Firmware 21.11.14; Centurysys Futurenet Nxr-610X Firmware 21.14.11c; Centurysys Futurenet Nxr-650 Firmware 21.16.2; Centurysys Futurenet Nxr-G050 Firmware 21.12.10; Centurysys Futurenet Nxr-G060 Firmware 21.15.6; Centurysys Futurenet Nxr-G100 Firmware 6.23.11; Centurysys Futurenet Nxr-G110 Firmware 21.7.32; Centurysys Futurenet Nxr-G120 Firmware 21.15.2c. Check the vendor advisory for mitigations.

References

• https://jvn.jp/en/vu/JVNVU96424864/
• https://www.centurysys.co.jp/backnumber/nxr_common/20240716-01.html
• https://www.centurysys.co.jp/backnumber/nxr_common/20240716-03.html
• https://jvn.jp/en/vu/JVNVU96424864/
• https://www.centurysys.co.jp/backnumber/nxr_common/20240716-01.html
• https://www.centurysys.co.jp/backnumber/nxr_common/20240716-03.html

Get alerted when CVE-2024-36475 or the next vulnerability affects your stack