Century Systems routers vulnerable to command injection

31 July 2024 high vulnerability

Century Systems FutureNet NXR, VXR, and WXR router series contain vulnerabilities allowing unrestricted Telnet access, arbitrary OS command execution, and data theft.

Japan's IPA has issued an alert regarding multiple vulnerabilities in Century Systems' FutureNet NXR series VPN routers, WXR series VPN routers, and VXR series virtual software routers. The vulnerabilities enable attackers to gain unrestricted Telnet access, execute arbitrary OS commands, and exfiltrate sensitive information. These routers are commonly deployed at network boundaries for VPN connectivity, particularly in organizations that migrated from ISDN dedicated lines to internet-based VPNs.

IPA warns that compromised devices could be weaponized as operational relay boxes (ORBs) to facilitate attacks against other organizations, similar to previously observed incidents involving other IoT router vendors. Some affected product models have reached end-of-support status, and Century Systems recommends discontinuing use or migrating to successor products for those devices.

The advisory emphasizes the risk that these routers may exist as unmanaged IT assets within organizations, blending into operational costs without proper inventory tracking. Organizations are urged to conduct asset discovery using services like SHODAN to identify exposed devices and apply vendor-provided firmware updates immediately for supported models.

Detection guidance

Inbound Telnet Access to Network Perimeter Device

ATT&CK T1190

Detects inbound Telnet (port 23) connections reaching a VPN/router perimeter device, indicating exposed or unrestricted Telnet management access that could be abused for unauthorized administrative access as described in the FutureNet router advisory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Inbound Telnet Access to Network Perimeter Device
logsource:
  category: network_connection
  product: network
detection:
  selection:
    dst_port: 23
    initiated: true
  filter_internal:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal
fields:
- src_ip
- dst_ip
- dst_port
falsepositives:
- Legacy management workstations still using Telnet for authorized device administration
- Network monitoring tools performing port scans for asset discovery
level: high
tags:
- attack.t1190
- attack.exploit_public_facing_application
id: d29f0917-18cd-5526-a963-a5ada2085ba9
status: experimental
author: Vorant

HTTP Request with Command Injection Patterns to Router Admin Interface

ATT&CK T1190

Detects HTTP requests containing shell metacharacters or command chaining sequences directed at router/VPN gateway web management endpoints, consistent with OS command injection exploitation of vulnerable FutureNet devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: HTTP Request with Command Injection Patterns to Router Admin Interface
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains:
    - cgi-bin
    - /admin
    - /goform
  injection_patterns:
    c-uri|contains:
    - ;
    - '|'
    - '`'
    - $(
    - '&&'
    - '%0a'
    - '%0d'
  condition: selection and injection_patterns
fields:
- c-ip
- c-uri
- cs-method
falsepositives:
- Vulnerability scanning tools authorized for security assessments
- Legitimate query strings containing pipe or ampersand characters from custom management
  scripts
level: high
tags:
- attack.t1190
- attack.t1059
id: f21c9038-8fbd-548a-ab7b-aef35a85d71e
status: experimental
author: Vorant

SSH Connection to Network Infrastructure Device from Unmanaged Source

ATT&CK T1021.004

Detects SSH connections to a router/VPN gateway from source addresses outside the expected management network range, potentially indicating lateral use of a compromised device as an operational relay box (ORB) or unauthorized remote administration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: SSH Connection to Network Infrastructure Device from Unmanaged Source
logsource:
  category: network_connection
  product: network
detection:
  selection:
    dst_port: 22
    initiated: true
  management_subnet:
    src_ip|cidr:
    - 10.10.10.0/24
  condition: selection and not management_subnet
fields:
- src_ip
- dst_ip
- dst_port
falsepositives:
- Break-glass administrative access from a jump host outside the defined management
  subnet
- Newly provisioned management workstations not yet added to the allow-list
level: medium
tags:
- attack.t1021.004
- attack.lateral_movement
id: f32873f9-68b1-5c3f-aa76-96b7bfe10104
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20240801.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free