PT-2025-3732 · Four Faith · Four-Faith F3X36
Jacob Baines
·
Published
2025-02-03
·
Updated
2025-03-10
·
CVE-2024-9644
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Four-Faith F3x36 router version 2.0.0
Description
The issue concerns an authentication bypass in the administrative web server of the Four-Faith F3x36 router. Specifically, authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. This allows a remote and unauthenticated user to modify settings or chain with existing authenticated vulnerabilities.
Recommendations
For Four-Faith F3x36 router version 2.0.0, consider disabling access to the "bapply.cgi" endpoint until a patch is available to prevent unauthorized modifications to settings. Restrict access to administrative functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Four-Faith F3X36