Description
The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Four-Faith | F3x24 | 2.0 | — |
| Four-Faith | F3x36 | 2.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
nu113d/CVE-2024-12856 ★ 3 · Jan 11, 2025
An exploit for Four-Faith routers to get a reverse shell
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://vulncheck.com/blog/four-faith-cve-2024-12856 exploit technical-description
- https://vulncheck.com/advisories/four-faith-time third-party-advisory
- https://ducklingstudio.blog.fc2.com/blog-entry-392.html exploit