7.2

CVE-2024-12856

Exploit

Four-Faith Industrial Router adjust_sys_time OS Command Injection

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Four-faith ≫ F3x36 Firmware Version2.0
   Four-faith ≫ F3x36 Version-
Four-faith ≫ F3x24 Firmware Version2.0
   Four-faith ≫ F3x24 Version-
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 82.19% 0.996
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
disclosure@vulncheck.com 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-1392 Use of Default Credentials

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://ducklingstudio.blog.fc2.com/blog-entry-392.html
Third Party Advisory
Exploit
https://vulncheck.com/advisories/four-faith-time
Third Party Advisory
https://vulncheck.com/blog/four-faith-cve-2024-12856
Third Party Advisory
Exploit