PT-2025-13560 · Futurenet · Futurenet Nxr Series

Published 2025-03-28 · Updated 2025-04-03 · CVE-2025-30485

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FutureNet NXR series, VXR series and WXR series routers (affected versions not specified)

Description The issue exists due to improper handling of symbolic link files. An attacker can exploit this by attaching an external storage containing malicious symbolic link files to the affected product. If successful, a logged-in administrative user may obtain and/or destroy internal files.

Recommendations For FutureNet NXR series, VXR series and WXR series routers, consider restricting access to external storage devices to minimize the risk of exploitation. As a temporary workaround, consider disabling the ability to attach external storage devices to the routers until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2025-30485

Affected Products

Futurenet Nxr Series

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-30485 · Security Note
• https://centurysys.co.jp/backnumber/common/jvnvu92821536.html · Note
• https://t.me/cvenotify/117521 · Telegram Post
• https://jvn.jp/en/vu/JVNVU92821536 · Note
• https://twitter.com/syedaquib77/status/1905631954994954336 · Twitter Post
• https://twitter.com/CVEnew/status/1907709604064113083 · Twitter Post