CVE-2024-9644
Four-Faith F3x36 bapply.cgi Auth Bypass
- State
- Published
- Severity
- 9.8 Critical
- Published
- Feb 4, 2025
- Updated
- Nov 19, 2025
- Reserved
- Oct 8, 2024
Description
The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. A remote and unauthenticated can use this vulnerability to modify settings or chain with existing authenticated vulnerabilities.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
F3x36Four-Faith |
|
References
- https://vulncheck.com/advisories/four-faith-hidden-apithird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.