CVE-2024-12856

high-risk
Published 2024-12-27

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.

Do I need to act?

!
73.9% chance of exploitation in next 30 days
EPSS score — higher than 26% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Four-Faith

References (4)

Exploit https://ducklingstudio.blog.fc2.com/blog-entry-392.html
Third Party Advisory https://vulncheck.com/advisories/four-faith-time
Exploit https://vulncheck.com/blog/four-faith-cve-2024-12856
Exploit https://vulncheck.com/blog/four-faith-cve-2024-12856
52
/ 100
high-risk
Severity 26/34 · High
Exploitability 19/34 · Moderate
Exposure 7/34 · Low