Four-Faith routers: OS command injection (CVE-2024-12856) #shorts

CVE

This CVE involves a critical OS command injection flaw in the Four-Faith router models F3x24 and F3x36, specifically affecting firmware version 2.0. This vulnerability, if exploited by authenticated remote attackers, allows for the execution of arbitrary commands on the host operating system. The flaw is accessed through HTTP when altering system time settings using apply.cgi. The presence of unchanged default credentials in this firmware version may escalate the threat, enabling unauthenticated remote command execution. As this is a recent discovery and labeled as a zero-day vulnerability, immediate attention is required from users of the affected router models.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://vulncheck.com/blog/four-faith-cve-2024-12856
• https://vulncheck.com/advisories/four-faith-time
• https://ducklingstudio.blog.fc2.com/blog-entry-392.html