CVE-2024-9643

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 3.04%
EPSS Percentile: 87.52%
CISA KEV: Not listed

Description

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests. This issue appears similar to CVE-2023-32645.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 04-Feb-2025 22:15
Last Modified: 17-Jun-2026 15:24
EPSS Date: 2026-11-02
CWE: CWE-489, CWE-798

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

four-faith / f3x36_firmware Source: NVD CPE · affected
Version / affected range: 2.0
cpe:2.3:o:four-faith:f3x36_firmware:2.0:*:*:*:*:*:*:*

References

Last enrichment sync: 03-Nov-2026 02:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Attackers are aggressively exploiting CVE-2024-9643, an authentication bypass flaw in Four-Faith F3x36 industrial cellular routers that stems from hardcoded administrative credentials. Security Roundup Covers Router Exploitation, CISA Credential Exposure and Gas Station Intrusions

CVE (1)

People (1)

Vendors (4)

Products (4)

Industries (1)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.