CVE-2024-9643 Four-Faith F3x36 Hidden Debug Credentials

CriticalCVSS 9.8 EPSS 3.0%

Published: 2025-02-04 16:47
Updated: 2026-06-17 11:24
Exploit status: No public exploit known

Description

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests. This issue appears similar to CVE-2023-32645.

Affected products

Product	Affected versions	Fixed in
four-faith F3x36	= 2.0.0	No fix listed
four-faith f3x36 firmware	= 2.0	No fix listed

References

vulncheck.com third-party-advisory
talosintelligence.com exploit not-applicable third-party-advisory

CVSS v3.1

9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (2)

v3.1 9.8 · vulncheck
v3.1 9.8 · disclosure@vulncheck.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.99% (percentile 87.6)
CWE: CWE-489 Active Debug Code CWE-798 Use of Hard-coded Credentials

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.