Threat actors attempt to exploit a flaw in Four
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-12168 | Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen. Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen. NVD description · AI analysis pending | 7.2 | 5% |
| — | ||
| CVE-2024-12856 | OS Command Injection in Four-Faith F3x24/F3x36 Routers Four-Faith industrial router models F3x24 and F3x36 running firmware version 2.0 are vulnerable to OS command injection (CWE-78) through the apply.cgi interface when an attacker modifies the system time over HTTP. The flaw is technically authenticated (CVSS 3.1: 7.2, network-adjacent-remote with high privileges required), but the same firmware ships with default credentials, so any device where defaults were not changed is effectively exposed to unauthenticated remote OS command execution. A successful attacker can run arbitrary commands on the router, gaining full device compromise that can be used for further access or recruitment into botnets. Four-Faith deployments — typically industrial and remote-connectivity routers — are affected, with at least 15,000 routers exposed to the internet and many retaining default credentials. Exploitation is confirmed in the wild: a Mirai botnet variant has weaponized the flaw for DDoS attacks, and the RondoDox botnet is also targeting it, consistent with a high EPSS score (84.2% probability of exploitation within 30 days, 100th percentile). Do: Update F3x24/F3x36 devices to the latest firmware available from Four-Faith and verify apply.cgi handling is fixed; as an immediate mitigation, change default administrator credentials and restrict HTTP management access to trusted networks. Check devices for signs of botnet infection (unexpected outbound traffic or Crontab/persistence changes) and prioritize patching given confirmed in-the-wild exploitation by Mirai and RondoDox botnets. | 7.2 | 84% | PoC ×2 |
| large≈15,000+ internet-exposed routers (headline scan count; total deployments likely higher) |
Full article261 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 30, 2024
VulnCheck researchers warn that threat actors are attempting to exploit a high-severity vulnerability impacting some Four-Faith routers.
Cybersecurity firm VulnCheck warns that a high-severity flaw, tracked as CVE-2024-12856 (CVSS score: 7.2), in Four-Faith routers is actively exploited in the wild.
The vulnerability is an operating system (OS) command injection vulnerability that impacts Four-Faith router models F3x24 and F3x36.
“At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi.” reads the advisory. “Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.”
VulnCheck researchers reported that authenticated attackers exploited default router credentials to execute unauthenticated remote command injections.
“VulnCheck observed a new post-authentication vulnerability affecting Four-Faith industrial routers being exploited in the wild.” reads the report published by VulnCheck. “The attacker leveraged the router’s default credentials, effectively resulting in unauthenticated remote command injection.”
Attackers are targeting Four-Faith F3x24 and F3x36 routers via the /apply.cgi endpoint over HTTP.
Censys identified more than 15,800 devices exposed inline vulnerable to OS command injection via the adj_time_year parameter when adjusting system time, enabling reverse shell exploitation.
“VulnCheck observed 178.215.238[.]91 attempting to exploit this vulnerability. Additionally, we note that this November 2024 blog also calls out exploitation of this vulnerability.” continues the cybersecurity firm.
Cybersecurity firm GreyNoise observed CVE-2019-12168 exploitation attempts on December 19, 2024.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Four-Faith routers)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/172450/hacking/four-faith-routers-flaw-exploited.html