9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: disclosure@vulncheck.com (Secondary)
Description
The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests. This issue appears similar to CVE-2023-32645.
Affected (1)
Products: Four Faith: F3x36 Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 2.0 |
| Running on/with | Platform Versions |
|---|---|
Four Faith F3x36 | All versions |
Related CWEs
CWE-489
Active Debug Code
The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
CWE-798
Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
References (3)
Source: disclosure@vulncheck.com
Not Applicable
Source: disclosure@vulncheck.com
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Not Applicable
Timeline
No history available yet.