CVE-2024-9644: Four-Faith F3x36 bapply.cgi Auth Bypass
First published: Tue Feb 04 2025(Updated: )
The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. A remote and unauthenticated can use this vulnerability to modify settings or chain with existing authenticated vulnerabilities.
Credit: disclosure@vulncheck.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Four-Faith F3x36 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-9644?
The severity of CVE-2024-9644 is considered critical due to the potential for unauthorized access to administrative functions.
How do I fix CVE-2024-9644?
To fix CVE-2024-9644, update the firmware of the Four-Faith F3x36 router to the latest version that addresses this vulnerability.
What are the risks associated with CVE-2024-9644?
The risks associated with CVE-2024-9644 include unauthorized access to router configuration, which could lead to compromise of the network.
Which devices are affected by CVE-2024-9644?
CVE-2024-9644 affects the Four-Faith F3x36 router running firmware version 2.0.0.
Is there a workaround for CVE-2024-9644?
Currently, disabling remote administration options could serve as a temporary workaround for CVE-2024-9644 until a firmware update is applied.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- agent/source
- agent/last-modified-date
- agent/tags
- agent/event
- vendor/four-faith
- canonical/four-faith f3x36