Century Systems FutureNet routers face exploitation risk
Century Systems FutureNet NXR/VXR/WXR router series contain vulnerabilities enabling unrestricted Telnet access, arbitrary OS command execution, and sensitive data theft.
Sourceipa.go.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Japan's IPA has issued a security alert regarding multiple vulnerabilities in Century Systems' FutureNet NXR, VXR, and WXR series routers. The NXR and WXR series are VPN routers for center and branch offices, while the VXR series consists of virtual software routers. Exploitation of these vulnerabilities could allow attackers unrestricted Telnet access, arbitrary OS command execution, and theft of sensitive information. The alert emphasizes particular concern for devices deployed during the transition from ISDN to internet-based VPNs, which may have been installed without proper IT asset management oversight.
IPA warns that compromised devices could serve as operational relay boxes (ORBs), enabling attackers to use them as pivot points for attacks against other organizations. Similar incidents have occurred with other IoT router vulnerabilities in the past. The agency recommends organizations verify whether these products are in use, even in shadow IT scenarios, and apply firmware updates immediately. Some affected products have reached end-of-support status, and for those devices, Century Systems recommends discontinuation or migration to successor products.
Organizations are urged to consult Century Systems' advisories for firmware update procedures and to consider using services like SHODAN to identify exposed devices within their networks. The alert underscores the risks of unmanaged network edge devices becoming attack vectors against both the host organization and third parties.
Detection guidance
Telnet Access Attempt to Network Edge Device from External Source
A behavioural hunt for the technique in general.
Detects inbound Telnet (port 23) connection attempts to network infrastructure/edge devices originating from outside internal address space, consistent with exploitation of unrestricted Telnet access on vulnerable FutureNet routers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Telnet Access Attempt to Network Edge Device from External Source
logsource:
category: firewall
detection:
selection:
dst_port: 23
action:
- allowed
- accept
filter_internal:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_internal
fields:
- src_ip
- dst_ip
- dst_port
- action
falsepositives:
- Legitimate remote management via Telnet from an authorized jump host that is misclassified
as external
- Vendor support access explicitly permitted through firewall rules
level: medium
tags:
- attack.t1190
id: 5bd2a36d-f82a-585e-967a-63344b989662
status: experimental
author: Vorant
SSH Connection to Network Appliance Management Interface from Untrusted Source
A behavioural hunt for the technique in general.
Detects SSH (port 22) connections to router/VPN appliance management interfaces originating from external or unexpected source networks, which may indicate exploitation of exposed management access on vulnerable FutureNet NXR/VXR/WXR devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH Connection to Network Appliance Management Interface from Untrusted Source
logsource:
category: firewall
detection:
selection:
dst_port: 22
action:
- allowed
- accept
filter_internal:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
filter_known_admin:
src_ip|cidr:
- 203.0.113.0/24
condition: selection and not filter_internal and not filter_known_admin
fields:
- src_ip
- dst_ip
- dst_port
falsepositives:
- Authorized remote administrators or MSPs connecting from known static IP ranges
not yet added to allow-list
- VPN concentrators terminating SSH management sessions from partner networks
level: medium
tags:
- attack.t1021.004
- attack.lateral-movement
id: 09b7d29b-ab34-5ece-9098-380d9156d825
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20240801.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs