Century Systems FutureNet MA/IP-K Series OS Command Injection and Info Disclosure (CVE-2025-54763/CVE-2025-58152)

Critical Vulnerability Information Overview CVE IDs: CVE-2025-54763, CVE-2025-58152 Affected Products: FutureNet MA and IP-K series Release Date: 2025/10/31 Last Updated: 2025/10/31 Discoverer: Chuya Hayakawa of 00One, Inc. Affected Devices FutureNet MA-X series: Versions 6.0.0 to 6.4.1 FutureNet MA-E300 series: Versions 5.0.0 to 6.2.1 FutureNet MA-S series: Versions 5.0.0 to 6.4.0 FutureNet MA-P series: Versions 5.0.0 to 6.4.0 FutureNet IP-K series: Versions 2.0.0 to 2.2.1 Vulnerability Description OS Command Injection (CWE-78) - CVSS Score: - Base Score: 8.6 - AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS:3.1 Base Score: 7.2 - AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Externally Accessible File or Directory (CWE-552) - CVSS Score: - Base Score: 6.9 - AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS:3.1 Base Score: 5.3 - AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Impact Users who log in to the product's Web UI may execute arbitrary OS commands (CVE-2025-54763) Firmware version and garbage collection information of affected products may be retrieved without authentication (CVE-2025-58152) Solution Firmware Update: Update firmware according to information provided by the developer Mitigation Measures: The developer also recommends applying mitigation measures; for details, refer to the "Vendor Status" section Vendor Status Vendor: Century Systems Co., Ltd. Status: Vulnerable Last Updated: 2025/10/31 Remarks: Century Systems Co., Ltd. official website References JPCERT/CC Addendum Security Vulnerabilities Analyzed by JPCERT/CC Additional Information JPCERT Alert JPCERT Report CERT Advisory CPNI Advisory TRnotes CVE: CVE-2025-54763, CVE-2025-58152 JVN iPed***

Goal Reached Thanks to every supporter — we hit 100%!

Century Systems FutureNet MA/IP-K Series OS Command Injection and Info Disclosure (CVE-2025-54763/CVE-2025-58152)