CVE-2025-24846: FutureNet AS Router Auth Bypass Flaw

CVE-2025-24846 Overview

CVE-2025-24846 is an authentication bypass vulnerability affecting FutureNet AS series industrial routers manufactured by Century Systems Co., Ltd. A remote, unauthenticated attacker can send a specially crafted request to retrieve device information, including the MAC address. The flaw is classified under [CWE-288: Authentication Bypass Using an Alternate Path or Channel].

The vulnerability requires no privileges and no user interaction, making it trivially exploitable against exposed devices. Disclosed details are tracked in the JVN Security Advisory and the Century Systems Security Notice.

Critical Impact

Remote unauthenticated attackers can extract device information such as MAC addresses from affected FutureNet AS series industrial routers, enabling reconnaissance for follow-on attacks against operational technology environments.

Affected Products

• Century Systems FutureNet AS series industrial routers
• Specific firmware versions listed in the JVN advisory JVNVU#96398949
• Industrial and OT deployments using FutureNet AS routers as edge gateways

Discovery Timeline

• 2025-03-03 - CVE-2025-24846 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-24846

Vulnerability Analysis

The vulnerability allows an attacker to bypass the authentication logic of the FutureNet AS series web management interface by sending a crafted HTTP request. Because the affected request handler does not validate the session or credentials before returning device metadata, the router responds with sensitive information regardless of authentication state.

While the disclosed impact is limited to information disclosure such as MAC address retrieval, this data supports adversary reconnaissance. Attackers can fingerprint deployed hardware, correlate devices across networks, and prepare targeted exploits for downstream OT systems.

Root Cause

The root cause is an authentication bypass mapped to [CWE-288]. A specific request path or channel exposed by the router omits the authentication check enforced on standard administrative endpoints. The handler returns device-identifying data directly from the device configuration without verifying the requester's identity.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network reachability to the management interface, including any device exposed to the internet or accessible from a compromised internal segment, can issue the crafted request and parse the response. The vulnerability does not provide write access or code execution but produces reliable information disclosure.

The vulnerability mechanism is described in the JVN Security Advisory. No public proof-of-concept code has been released, and CISA has not added CVE-2025-24846 to the Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-24846

Indicators of Compromise

• Unauthenticated HTTP or HTTPS requests to FutureNet AS management endpoints from external or unexpected internal sources
• Repeated probes against router web interfaces returning HTTP 200 responses without prior authentication exchanges
• Outbound enumeration patterns where MAC address values from FutureNet devices appear in attacker-controlled telemetry

Detection Strategies

• Inspect web server access logs on FutureNet AS routers for requests to administrative paths lacking session cookies or authentication headers
• Deploy network IDS signatures matching the crafted request patterns described in the Century Systems advisory once published
• Correlate scanning activity targeting TCP ports used by the FutureNet management interface across multiple devices

Monitoring Recommendations

• Continuously monitor management plane traffic to industrial routers for anomalous request volumes or off-hours access
• Alert on any direct internet exposure of FutureNet AS management interfaces using external attack surface tools
• Forward router logs to a centralized SIEM or data lake for retention and behavioral analysis

How to Mitigate CVE-2025-24846

Immediate Actions Required

• Apply the firmware update published by Century Systems as referenced in the Century Systems Security Notice
• Restrict access to the router management interface to trusted administrative networks using ACLs or firewall rules
• Inventory all FutureNet AS series devices in OT and IT environments and confirm firmware versions

Patch Information

Century Systems Co., Ltd. has published guidance for affected FutureNet AS series industrial routers. Administrators should consult the JVN Security Advisory and the vendor's Security Notice for fixed firmware versions and upgrade procedures.

Workarounds

• Block external access to the router HTTP and HTTPS management ports until the firmware update is applied
• Place FutureNet AS routers behind a VPN or jump host so that management endpoints are unreachable from untrusted networks
• Disable the web management interface where alternative management channels such as serial or out-of-band consoles are available
• Segment industrial networks to limit lateral exposure of router management planes from general user subnets