CVE-2025-24846

Authentication bypass vulnerability exists in FutureNet AS series (Industrial Routers) provided by Century Systems Co., Ltd. If this vulnerability is exploited, a remote unauthenticated attacker may obtain the device information such as MAC address by sending a specially crafted request.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/vu/JVNVU96398949/
https://www.centurysys.co.jp/backnumber/common/jvnvu96398949.html

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de omisión de autenticación en la serie FutureNet AS (enrutadores industriales) proporcionados por Century Systems Co., Ltd. Si se explota esta vulnerabilidad, un atacante remoto no autenticado puede obtener información del dispositivo, como la dirección MAC, enviando una solicitud especialmente manipulada.

03 Mar 2025, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-03 09:15

Updated : 2026-06-17 08:59

NVD link : CVE-2025-24846

Mitre link : CVE-2025-24846

CVE.ORG link : CVE-2025-24846

JSON object : View

Products Affected

No product.

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2025-24846", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-24846", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-03T13:15:19.774363Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "vultures@jpcert.or.jp", "affectedData": [{"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-250/S", "versions": [{"status": "affected", "version": "firmware Version 1.14.0 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-250/F-SC", "versions": [{"status": "affected", "version": "firmware Version 1.14.0 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-250/F-KO", "versions": [{"status": "affected", "version": "firmware Version 1.14.0 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-250/NL", "versions": [{"status": "affected", "version": "firmware Version 1.14.0 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-250/KL", "versions": [{"status": "affected", "version": "firmware Version 1.14.0 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-250/KL Rev2", "versions": [{"status": "affected", "version": "firmware Version 2.6.4 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-250/L", "versions": [{"status": "affected", "version": "firmware Version 2.6.4 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-M250/L", "versions": [{"status": "affected", "version": "firmware Version 2.6.4 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-M250/KL", "versions": [{"status": "affected", "version": "firmware Version 2.6.4 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-M250/NL", "versions": [{"status": "affected", "version": "firmware Version 2.6.4 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-P250/NL", "versions": [{"status": "affected", "version": "firmware Version 2.6.4 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-P250/KL", "versions": [{"status": "affected", "version": "firmware Version 2.6.4 and earlier"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet AS-210/U4", "versions": [{"status": "affected", "version": "firmware Version 2.6.4 and earlier"}]}]}], "published": "2025-03-03T09:15:39.817", "references": [{"url": "https://jvn.jp/en/vu/JVNVU96398949/", "source": "vultures@jpcert.or.jp"}, {"url": "https://www.centurysys.co.jp/backnumber/common/jvnvu96398949.html", "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "Authentication bypass vulnerability exists in FutureNet AS series (Industrial Routers) provided by Century Systems Co., Ltd. If this vulnerability is exploited, a remote unauthenticated attacker may obtain the device information such as MAC address by sending a specially crafted request."}, {"lang": "es", "value": "Existe una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en la serie FutureNet AS (enrutadores industriales) proporcionados por Century Systems Co., Ltd. Si se explota esta vulnerabilidad, un atacante remoto no autenticado puede obtener informaci\u00f3n del dispositivo, como la direcci\u00f3n MAC, enviando una solicitud especialmente manipulada."}], "lastModified": "2026-06-17T08:59:42.443", "sourceIdentifier": "vultures@jpcert.or.jp"}