CVE-2024-9643CWE-489CWE-798

Four-Faith F3x36 Hidden Debug Credentials

Critical · published February 4, 2025

CVSS v3.1
9.8
EPSS
3%
Percentile
87.3
In the wild
Unconfirmed
What it is

🚨 An attacker with just a few HTTP requests can waltz right into the admin panel of your Four-Faith F3x36 router because of hard-coded credentials! 🔥 This vulnerability is like finding a master key hidden under the doormat of your router's front door — no one should have access, but here the password is practically handed out! With these hard-coded credentials, an attacker could easily gain administrative access and potentially take full control of your network, snooping on traffic, changing settings, or even launching attacks on connected devices. This could lead to absolutely devastating breaches and a compromised home or office network!

Put simply

This vulnerability is like finding a master key hidden under the doormat of your router's front door — no one should have access, but here the password is practically handed out! This vulnerability allows attackers to bypass authentication on the Four-Faith F3x36 router firmware v2.0.0 by exploiting hard-coded credentials embedded in the web server, enabling unauthorized administrative access.

What to do

With these hard-coded credentials, an attacker could easily gain administrative access and potentially take full control of your network, snooping on traffic, changing settings, or even launching attacks on connected devices. This could lead to absolutely devastating breaches and a compromised home or office network! Update the router's firmware to the latest version immediately to eliminate the hard-coded credentials vulnerability. If an update isn't available, consider isolating the device from critical network traffic until a patch is issued! Don’t panic! You’ve got this — take action now and protect your network like the hero you are! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03039 · 87.3th percentile
Weaknesses
CWE-489 · Active Debug Code; CWE-798 · Use of Hard-coded Credentials
Published
2025-02-04T14:47Z
EPSS history
Timeline
  • 04 FEB 14:47Z
    Four-Faith F3x36 Hidden Debug Credentials
    cvelistv5