CVE-2024-12856

Four-Faith Industrial Router adjust_sys_time OS Command Injection

State: Published
Severity: 7.2 High
Published: Dec 27, 2024
Updated: Nov 22, 2025
Reserved: Dec 20, 2024

Description

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-1392 Use of Default Credentials

Affected Products

Product	Versions
F3x24Four-Faith	2.0Affected
F3x36Four-Faith	2.0Affected

References

https://vulncheck.com/blog/four-faith-cve-2024-12856exploittechnical-description
https://vulncheck.com/advisories/four-faith-timethird-party-advisory
https://ducklingstudio.blog.fc2.com/blog-entry-392.htmlexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.