CVE-2024-12856 is an OS command injection vulnerability affecting Four-Faith F3x24 and F3x36 router models, specifically firmware version 2.0. Authenticated, remote attackers can execute arbitrary OS commands via the apply.cgi endpoint when modifying system time. The vulnerability is rated HIGH (CVSS 7.2) due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Default credentials in affected firmware versions can escalate this to an unauthenticated remote execution. This CVE is actively exploited in the wild, with reports of Mirai and RondoDox botnets leveraging it, and has garnered significant community discussion and media coverage despite no public exploit code being available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.0CPE matchmatch criteria | cpe:2.3:o:four-faith:f3x36_firmware:2.0:*:*:*:*:*:*:* | ||
2.0CPE matchmatch criteria | cpe:2.3:o:four-faith:f3x24_firmware:2.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.