CVE-2025-54763

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-54763", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2025-10-17T08:08:15.679Z", "datePublished": "2025-10-31T05:55:24.573Z", "dateUpdated": "2025-10-31T17:15:10.387Z"}, "containers": {"cna": {"affected": [{"vendor": "Century Systems Co., Ltd.", "product": "FutureNet MA-X series", "versions": [{"version": "from 6.0.0 to 6.4.1", "status": "affected"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet MA-E300 series", "versions": [{"version": "from 5.0.0 to 6.2.1", "status": "affected"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet MA-S series", "versions": [{"version": "from 5.0.0 to 6.4.0", "status": "affected"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet MA-P series", "versions": [{"version": "from 5.0.0 to 6.4.0", "status": "affected"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet IP-K series", "versions": [{"version": "from 2.0.0 to 2.2.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the Web UI of the product may execute an arbitrary OS command."}], "problemTypes": [{"descriptions": [{"description": "Improper neutralization of special elements used in an OS command ('OS Command Injection')", "lang": "en-US", "cweId": "CWE-78", "type": "CWE"}]}], "references": [{"url": "https://www.centurysys.co.jp/backnumber/common/jvnvu98191201.html"}, {"url": "https://jvn.jp/en/vu/JVNVU98191201/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-10-31T05:55:24.573Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-31T17:09:21.191509Z", "id": "CVE-2025-54763", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T17:15:10.387Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-54763", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-31T17:09:21.191509Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T17:09:26.986Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Century Systems Co., Ltd.", "product": "FutureNet MA-X series", "versions": [{"status": "affected", "version": "from 6.0.0 to 6.4.1"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet MA-E300 series", "versions": [{"status": "affected", "version": "from 5.0.0 to 6.2.1"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet MA-S series", "versions": [{"status": "affected", "version": "from 5.0.0 to 6.4.0"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet MA-P series", "versions": [{"status": "affected", "version": "from 5.0.0 to 6.4.0"}]}, {"vendor": "Century Systems Co., Ltd.", "product": "FutureNet IP-K series", "versions": [{"status": "affected", "version": "from 2.0.0 to 2.2.1"}]}], "references": [{"url": "https://www.centurysys.co.jp/backnumber/common/jvnvu98191201.html"}, {"url": "https://jvn.jp/en/vu/JVNVU98191201/"}], "descriptions": [{"lang": "en", "value": "FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the Web UI of the product may execute an arbitrary OS command."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-78", "description": "Improper neutralization of special elements used in an OS command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-10-31T05:55:24.573Z"}}}, "cveMetadata": {"cveId": "CVE-2025-54763", "state": "PUBLISHED", "dateUpdated": "2025-10-31T17:15:10.387Z", "dateReserved": "2025-10-17T08:08:15.679Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2025-10-31T05:55:24.573Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FutureNet MA-X series", "vendor": "Century Systems Co., Ltd.", "versions": [{"status": "affected", "version": "from 6.0.0 to 6.4.1"}]}, {"product": "FutureNet MA-E300 series", "vendor": "Century Systems Co., Ltd.", "versions": [{"status": "affected", "version": "from 5.0.0 to 6.2.1"}]}, {"product": "FutureNet MA-S series", "vendor": "Century Systems Co., Ltd.", "versions": [{"status": "affected", "version": "from 5.0.0 to 6.4.0"}]}, {"product": "FutureNet MA-P series", "vendor": "Century Systems Co., Ltd.", "versions": [{"status": "affected", "version": "from 5.0.0 to 6.4.0"}]}, {"product": "FutureNet IP-K series", "vendor": "Century Systems Co., Ltd.", "versions": [{"status": "affected", "version": "from 2.0.0 to 2.2.1"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the Web UI of the product may execute an arbitrary OS command."}, {"lang": "es", "value": "Las series FutureNet MA e IP-K proporcionadas por Century Systems Co., Ltd. contienen una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo. Un usuario que inicia sesi\u00f3n en la interfaz de usuario web del producto puede ejecutar un comando arbitrario del sistema operativo."}], "id": "CVE-2025-54763", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54763", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-31T17:09:21.191509Z", "version": "2.0.3"}}]}, "published": "2025-10-31T06:15:33.573", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/vu/JVNVU98191201/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.centurysys.co.jp/backnumber/common/jvnvu98191201.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"created": "2025-11-03T10:45:10.774623+00:00", "updated": "2025-11-03T10:45:10.774646+00:00", "vendors": ["centurysys", "centurysys$PRODUCT$futurenet_ip-k_series", "centurysys$PRODUCT$futurenet_ma-e300_series", "centurysys$PRODUCT$futurenet_ma-p_series", "centurysys$PRODUCT$futurenet_ma-s_series", "centurysys$PRODUCT$futurenet_ma-x_series"]}