Century Systems FutureNet routers face exploitation risk
Century Systems FutureNet NXR/VXR/WXR router series contain vulnerabilities enabling unrestricted Telnet access, arbitrary OS command execution, and sensitive data theft.
Japan's IPA has issued a security alert regarding multiple vulnerabilities in Century Systems' FutureNet NXR, VXR, and WXR series routers. The NXR and WXR series are VPN routers for center and branch offices, while the VXR series consists of virtual software routers. Exploitation of these vulnerabilities could allow attackers unrestricted Telnet access, arbitrary OS command execution, and theft of sensitive information. The alert emphasizes particular concern for devices deployed during the transition from ISDN to internet-based VPNs, which may have been installed without proper IT asset management oversight.
IPA warns that compromised devices could serve as operational relay boxes (ORBs), enabling attackers to use them as pivot points for attacks against other organizations. Similar incidents have occurred with other IoT router vulnerabilities in the past. The agency recommends organizations verify whether these products are in use, even in shadow IT scenarios, and apply firmware updates immediately. Some affected products have reached end-of-support status, and for those devices, Century Systems recommends discontinuation or migration to successor products.
Organizations are urged to consult Century Systems' advisories for firmware update procedures and to consider using services like SHODAN to identify exposed devices within their networks. The alert underscores the risks of unmanaged network edge devices becoming attack vectors against both the host organization and third parties.
Detection guidance
Telnet Access Attempt to Network Edge Device from External Source
Detects inbound Telnet (port 23) connection attempts to network infrastructure/edge devices originating from outside internal address space, consistent with exploitation of unrestricted Telnet access on vulnerable FutureNet routers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Telnet Access Attempt to Network Edge Device from External Source
logsource:
category: firewall
product: network
detection:
selection:
dst_port: 23
action:
- allowed
- accept
filter_internal:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_internal
fields:
- src_ip
- dst_ip
- dst_port
- action
falsepositives:
- Legitimate remote management via Telnet from an authorized jump host that is misclassified
as external
- Vendor support access explicitly permitted through firewall rules
level: medium
tags:
- attack.t1190
- attack.exploit_public_facing_application
id: 5bd2a36d-f82a-585e-967a-63344b989662
status: experimental
author: Vorant
SSH Connection to Network Appliance Management Interface from Untrusted Source
Detects SSH (port 22) connections to router/VPN appliance management interfaces originating from external or unexpected source networks, which may indicate exploitation of exposed management access on vulnerable FutureNet NXR/VXR/WXR devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH Connection to Network Appliance Management Interface from Untrusted Source
logsource:
category: firewall
product: network
detection:
selection:
dst_port: 22
action:
- allowed
- accept
filter_internal:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
filter_known_admin:
src_ip|cidr:
- 203.0.113.0/24
condition: selection and not filter_internal and not filter_known_admin
fields:
- src_ip
- dst_ip
- dst_port
falsepositives:
- Authorized remote administrators or MSPs connecting from known static IP ranges
not yet added to allow-list
- VPN concentrators terminating SSH management sessions from partner networks
level: medium
tags:
- attack.t1021.004
- attack.lateral_movement
id: 09b7d29b-ab34-5ece-9098-380d9156d825
status: experimental
author: Vorant
Network Edge Device Exhibiting Proxy-like Outbound Relay Behavior
Detects a network edge/router device establishing outbound connections to external destinations on common relay ports, consistent with a compromised device being used as an Operational Relay Box (ORB) to pivot traffic to third-party targets; analysts should corroborate with volume/diversity of destination IPs over a short window, which this rule does not enumerate directly. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Network Edge Device Exhibiting Proxy-like Outbound Relay Behavior
logsource:
category: network_connection
product: network
detection:
selection:
src_category: network_appliance
dst_port:
- 80
- 443
- 8080
- 1080
initiated: true
filter_known_services:
dst_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_known_services
fields:
- src_ip
- dst_ip
- dst_port
falsepositives:
- Legitimate firmware update or telemetry check-in traffic from the router to vendor
cloud services
- Router-based reverse proxy or VPN termination intentionally configured by the organization
level: low
tags:
- attack.t1090
- attack.command_and_control
id: 3b4ff4fe-90fa-566d-bde4-2e39b36bc53d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20240801.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free