Threat actors have been observed exploiting a vulnerability in Four-Faith industrial routers to deploy a reverse shell, vulnerability intelligence company VulnCheck warns.

The exploited flaw, tracked as CVE-2024-12856 (CVSS score of 7.2), is described as an OS command injection issue that can be exploited remotely but requires authentication.

Affected devices include the Four-Faith router models F3x24 and F3x36 running firmware version 2.0, which was also found to include default credentials that can be used to gain unauthenticated remote command injection.

“At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi,” a NIST advisory reads.

“Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue,” it continues.

According to VulnCheck, the attackers have been observed modifying the system time parameter using POST requests over HTTP. Roughly 15,000 internet-facing router models from the Chinese communications equipment manufacturer could be affected by the security defect.

The first attacks exploiting CVE-2024-12856 were observed by others in November 2024, and VulnCheck says that the identified User-Agents are like those it has seen, although the payload has been modified. The attacks have been originating from at least two different IP addresses.

The attacks, VulnCheck also notes, may appear as exploitation attempts targeting CVE-2019-12168, another bug involving the apply.cgi endpoint, but have different underlying components.

VulnCheck says it notified Four-Faith about the vulnerability’s in-the-wild exploitation on December 20, but it is unclear when a patch would be rolled out. 

SecurityWeek reached out to Four-Faith for additional information on the matter and will update this article as soon as a reply arrives.

Related: Adobe Patches ColdFusion Flaw at High Risk of Exploitation

Related: In Other News: McDonald’s API Hacking, Netflix Fine, Malware Kills ICS Process  

Related: FBI Warns of HiatusRAT Attacks on Cameras, DVR Systems

Related: Upskilling Cyber Defenders Requires a Readiness Environment