CVE-2024-9643

The router firmware contains hard-coded credentials that cannot be changed by the user in the standard way. An attacker who obtains knowledge of these authentication credentials can send properly crafted HTTP requests to the device's administrative panel. The authentication mechanism is bypassed in this manner, and the attacker gains full administrative access to the device. The vulnerability is similar to the previously documented CVE-2023-32645 vulnerability.

An attacker gains full administrative access to the router, enabling them to change device configuration, intercept network traffic, modify network settings, and potentially use the device as an entry point for further lateral movement in the network.

Apply patches available from the manufacturer according to the references. As a temporary measure until a patch is deployed, it is recommended to restrict access to the device's administrative panel exclusively to trusted IP addresses and isolate the device from public access through a firewall or VPN.

Four-Faith F3x36 router with firmware version v2.0.0