CVE-2024-9643

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests. This issue appears similar to CVE-2023-32645.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - disclosure@vulncheck.com

Published

2025-02-04

Last modified

2025-11-22

Weaknesses

CWE-489, CWE-798

Affected products

• F3x24 (Four-faith)
• F3x36 Firmware (Four-faith)

References

• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1752
• https://vulncheck.com/advisories/four-faith-hard-coded-creds