CVE

CVE-2024-9643

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests. This issue appears similar to CVE-2023-32645.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

f3x36

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalExposed Panels~10 seconds

Four-Faith F3x36 - Authentication Bypass

Four-Faith F3x36 router with firmware v2.0.0 contains an authentication bypass caused by hard-coded credentials in the administrative web server, letting attackers with knowledge of credentials gain administrative access via crafted HTTP requests. References: https://vulncheck.com/advisories/four-faith-hard-coded-creds https://talosintelligence.com/vulnerability_reports/TALOS-2023-1752 Remediation: Update to the latest firmware version provided by the vendor to fix hard-coded credential issues.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: f3x36

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →