Vulnerability · Published Feb 4, 2025 · Assigned by VulnCheck

CVE-2024-9644Four-Faith F3x36 bapply.cgi Auth Bypass

Critical 9.8

In plain English

A critical-severity missing authentication in F3x36 from Four-Faith. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.7%top 47.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. A remote and unauthenticated can use this vulnerability to modify settings or chain with existing authenticated vulnerabilities.

Affected products (as reported)

Vendor	Product	Versions
Four-Faith	F3x36	2.0.0

Weakness: CWE-489, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://vulncheck.com/advisories/four-faith-hidden-api third-party-advisory