CVE-2025-58152 Overview
CVE-2025-58152 affects FutureNet MA and IP-K series network devices manufactured by Century Systems Co., Ltd. The devices expose firmware version details and garbage collection information through internal web pages. A remote attacker can retrieve this data by sending crafted HTTP requests without providing authentication. The issue is classified under [CWE-552] as files or directories accessible to external parties. The vulnerability carries a CVSS 4.0 score of 6.9 and results in confidentiality impact only, with no effect on integrity or availability.
Critical Impact
Unauthenticated remote attackers can read firmware version and garbage collection details from affected FutureNet devices, aiding reconnaissance for follow-on attacks.
Affected Products
- Century Systems FutureNet MA series
- Century Systems FutureNet IP-K series
- Specific firmware versions listed in the vendor advisory
Discovery Timeline
- 2025-10-31 - CVE-2025-58152 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58152
Vulnerability Analysis
The vulnerability resides in the internal web interface of FutureNet MA and IP-K series routers. The devices render firmware version data and garbage collection statistics on internal administrative pages. These pages are intended for authenticated administrators, yet the web application does not consistently enforce authentication on the underlying resources. An attacker who can reach the management interface over the network can craft HTTP requests targeting the exposed endpoints and receive sensitive device details in the response.
The disclosed firmware version enables attackers to identify known vulnerabilities tied to specific builds. Garbage collection information can reveal internal memory management state and operational patterns useful for further exploitation research. The flaw does not permit modification of configuration or disruption of service, but it materially assists reconnaissance against embedded network infrastructure.
The EPSS score of 0.296% places active exploitation likelihood in the lower range, though public exposure of management interfaces increases opportunistic scanning risk.
Root Cause
The root cause is missing authorization on selected web resources within the device firmware. The application logic serves diagnostic content without validating an active administrative session. This is a classic instance of [CWE-552] where files or directories intended for internal use remain reachable to external parties.
Attack Vector
An attacker sends a crafted HTTP GET request to the device management interface. The device responds with firmware version strings and garbage collection metrics without prompting for credentials. No user interaction, privileges, or supporting infrastructure is required beyond network reachability to the target device.
No verified proof-of-concept code is publicly available. Refer to the JVN Security Vulnerability Report for technical details published by the coordinator.
Detection Methods for CVE-2025-58152
Indicators of Compromise
- Unauthenticated HTTP GET requests to internal diagnostic paths on FutureNet MA or IP-K devices
- Web access logs showing responses containing firmware version strings returned to unauthenticated clients
- Repeated requests from external or unexpected internal IP ranges targeting device management ports
Detection Strategies
- Inspect device web server logs for HTTP 200 responses to diagnostic URIs where no session cookie or authentication header was presented
- Deploy network intrusion detection signatures that flag requests to FutureNet management endpoints from non-administrative source networks
- Correlate reconnaissance activity against embedded devices with subsequent authentication attempts or configuration changes
Monitoring Recommendations
- Restrict access to device management interfaces to a dedicated administrative VLAN and monitor cross-VLAN attempts
- Enable syslog forwarding from FutureNet devices to a centralized log platform for retention and analysis
- Baseline expected HTTP request volume to management interfaces and alert on deviations
How to Mitigate CVE-2025-58152
Immediate Actions Required
- Block access to the device web management interface from untrusted networks using upstream firewall or access control list rules
- Enumerate all FutureNet MA and IP-K deployments and confirm firmware versions against the vendor advisory
- Apply the vendor-provided firmware update as soon as it is available for the affected models
Patch Information
Century Systems has published guidance through the CenturySys JVN Vulnerability Notification. Administrators should consult the vendor page for fixed firmware versions applicable to their specific model and apply updates following the vendor procedure.
Workarounds
- Limit the management interface to trusted source addresses using device-side access controls
- Place affected devices behind a reverse proxy or firewall that enforces authentication before requests reach the device
- Disable the internal web interface when out-of-band management options are available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
