CVE-2024-12856

ÉLEVÉE 7.2CVE-2024-12856 · Published 27/12/2024 · updated 17/06/2026

En bref

CVE-2024-12856 est une vulnérabilité ÉLEVÉE (CVSS 7.2).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 84.1%, plus élevée que 99.7% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.

References

ducklingstudio.blog.fc2.com/blog-entry-392.html · Exploit
vulncheck.com/advisories/four-faith-time · Third Party Advisory
vulncheck.com/blog/four-faith-cve-2024-12856 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free