Vulnerability · Published Dec 27, 2024 · Assigned by VulnCheck
CVE-2024-12856Four-Faith Industrial Router adjust_sys_time OS Command Injection
High 7.2
In plain English
A high-severity OS command injection in F3x24 from Four-Faith. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 84.1% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Four-Faith | F3x24 | 2.0 |
| Four-Faith | F3x36 | 2.0 |
Weakness: CWE-78, CWE-1392 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://vulncheck.com/blog/four-faith-cve-2024-12856 exploit, technical-description
- https://vulncheck.com/advisories/four-faith-time third-party-advisory
- https://ducklingstudio.blog.fc2.com/blog-entry-392.html exploit