CVE-2024-9644

Summary

CVE-2024-9644 is a newly discovered vulnerability affecting the Four-Faith F3x36 router. The issue lies in the administrative web server of the device, where authentication is bypassed when using the "bapply.cgi" endpoint instead of the standard "apply.cgi" endpoint. With no authentication required, a remote and unauthenticated attacker can exploit this vulnerability to modify settings and potentially chain it with other authenticated vulnerabilities, posing a significant risk to network security. Organizations using the affected firmware version (v2.0.0) are advised to update their routers as soon as possible to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.