1. Home
  2. CVE Database
  3. CVE-2024-9644
CRITICAL · 9.8

CVE-2024-9644

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative funct...

Vulnerability Description

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. A remote and unauthenticated can use this vulnerability to modify settings or chain with existing authenticated vulnerabilities.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Four-FaithF3X36 Firmware2.0
Four-FaithF3X36-

Related Weaknesses (CWE)

CWE-489CWE-306

References

FAQ

What is CVE-2024-9644?

CVE-2024-9644 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative funct...

How severe is CVE-2024-9644?

CVE-2024-9644 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2024-9644?

Check the references section above for vendor advisories and patch information. Affected products include: Four-Faith F3X36 Firmware, Four-Faith F3X36.