CVE-2024-12856 - CVE House
Back to Database
Status published High CVE-2024-12856

Four-Faith Industrial Router adjust_sys_time OS Command Injection

Vulnerability Description

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-12856

Credits & Attribution

No credits recorded in the NVD database.

References

More from Four-Faith

View All →
CVE-2025-11337
Four-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversal
Medium 6.9
CVE-2025-11336
Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal
Medium 6.9
CVE-2025-11018
Four-Faith Water Conservancy Informatization Platform download.do;usrlogout.do.do path traversal
Medium 6.9
CVE-2025-10709
Four-Faith Water Conservancy Informatization Platform historyDownload.do;otheruserLogin.do;getfile path traversal
Medium 6.9
CVE-2025-10708
Four-Faith Water Conservancy Informatization Platform historyDownload.do;usrlogout.do path traversal
Medium 6.9

Affected Vendor

Affected Software

F3x24, F3x36
Vulnerable Versions:
2.0

Timeline

Official Publish: December 27th, 2024
Last Modified: November 22nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78 CWE-1392

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration