Four-Faith Routers Exploited Using New Flaw

Hackers are exploiting a high-severity command injection vulnerability in Chinese-manufactured Four-Faith industrial routers.

See Also: ESG Report: Analyzing the Economic Benefits of Palo Alto Networks Industrial OT Security

The vulnerability, tracked as CVE-2024-12856, affects F3x24 and F3x36 router models. It allows remote command execution through the router’s default credentials, potentially compromising thousands of devices, according to a report by VulnCheck.

Typical customers of Four-Faith use the routers for remote monitoring, control systems, supervisory control and data acquisition networks. Customers include industrial automation, factories and manufacturing plants, power grids, renewable energy plants, water utilities, and transportation and logistics for fleet management and vehicle tracking for real-time data transmission.

The vulnerability, with a CVSS score of 7.2, resides in the /apply.cgi endpoint, where attackers can exploit the adj_time_year parameter. VulnCheck discovered that malicious actors bypass authentication by leveraging default login credentials, escalating the risk for unpatched systems.

Researchers said that approximately 15,000 internet-facing devices are susceptible to the attack, based on a scan conducted using Censys. Exploitation can result in reverse shell execution, granting attackers unauthorized control over the affected routers.

An active exploitation campaign originating from IP address 178.215.238.91 was observed, indicating widespread targeting. VulnCheck also identified matching user-agent strings between their findings and previous exploitation attempts documented in November.

To detect exploitation attempts, VulnCheck developed a Suricata rule. This rule identifies suspicious HTTP POST requests containing parameters indicative of the attack, enabling organizations to fortify their defenses.

Four-Faith was notified about the vulnerability on Dec. 20, under VulnCheck’s responsible disclosure policy. The details about patches or firmware updates remain unavailable at this time. Users of affected router models are advised to change default credentials, limit network exposure and monitor device activity closely, researchers said.