ИнструментыУязвимости БДУБлоклистыРасширениеУтилитыБлогAPIМониторинг
Главная → Уязвимости → CVE-2024-12856
7.2высокая

CVE-2024-12856

→ есть в БДУ: BDU:2025-00162 (на русском)
Описание (на английском; русское — в БДУ выше)

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.

Затрагиваемое ПО
Four-faith F3x36 firmwareFour-faith F3x36Four-faith F3x24 firmwareFour-faith F3x24
CVSS
Балл7.2 — высокая
ВекторCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Источники
https://ducklingstudio.blog.fc2.com/blog-entry-392.htmlhttps://vulncheck.com/advisories/four-faith-timehttps://vulncheck.com/blog/four-faith-cve-2024-12856https://vulncheck.com/blog/four-faith-cve-2024-12856