CVE-2024-12856highobserved exploitationCWE-1392CWE-78

CVE-2024-12856: high-severity vulnerability in Four-Faith F3x24

Four-Faith Industrial Router adjust_sys_time OS Command Injection

Published · Updated

Follow this CVE+ Monitor F3x36+ Monitor F3x24

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 7.2epss 84%
from disclosure to weapon15 days
Published on NVDDec 27
1st PoC+15d
VulnCheckNov 9
In short

A Four-Faith industrial router (models F3x24 and F3x36) allows attackers to run harmful commands on the device by manipulating the system time settings. If the default password is not changed, anyone on the internet can exploit this without needing legitimate access.

Technical detail

An OS command injection vulnerability exists in the apply.cgi endpoint when processing system time adjustments. Authenticated remote attackers can inject arbitrary OS commands; the presence of unchanged default credentials eliminates the authentication barrier, enabling unauthenticated remote code execution with network-level access.

Summary generated and translated by AI from the official description.
The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Four-Faith · F3x24Four-Faith · F3x36
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Four-Faith F3x24

In the same product, most dangerous first.

CVE-2024-9643CRITICALFour-Faith F3x36 Hidden Debug CredentialsEPSS 3.0%CVE-2024-9644CRITICALFour-Faith F3x36 bapply.cgi Auth BypassEPSS 0.7%