← Back

CVE-2024-12856

nvd nist
Published: Dec 27, 2024Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: disclosure@vulncheck.com (Secondary)

Description

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.

Affected (2)

Four Faith
2 products
F3x36 Firmware
F3x24 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
F3x36 Firmware
Version 2.0
Running on/withPlatform Versions
Four Faith
F3x36
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
F3x24 Firmware
Version 2.0
Running on/withPlatform Versions
Four Faith
F3x24
All versions

Related CWEs

CWE-1392
Use of Default Credentials
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (4)

Source: disclosure@vulncheck.com
ExploitThird Party Advisory
Source: disclosure@vulncheck.com
Third Party Advisory
Source: disclosure@vulncheck.com
ExploitThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitThird Party Advisory

Timeline

No history available yet.