Article Details
Scrape Timestamp (UTC): 2024-12-30 18:08:00.196
Original Article Text
Click to Toggle View
Hackers exploit Four-Faith router flaw to open reverse shells. Threat actors are exploiting a post-authentication remote command injection vulnerability in Four-Faith routers tracked as CVE-2024-12856 to open reverse shells back to the attackers. The malicious activity was discovered by VulnCheck, who informed Four-Faith about the active exploitation on December 20, 2024. However, it is unclear if security updates for the vulnerability are currently available. "We notified Four-Faith and our customers about this issue on December 20, 2024. Questions about patches, affected models, and affected firmware versions should be directed at Four-Faith." explains the VulnCheck report. Flaw details and scope CVE-2024-12856 is an OS command injection flaw impacting Four-Faith router models F3x24 and F3x36, typically deployed in energy and utilities, transportation, telecommunications, and manufacturing sectors. VulnCheck says hackers can gain access to those devices because many are configured with default credentials, which are easy to brute force. The attack begins with the transmission of a specially crafted HTTP POST request to the router's '/apply.cgi' endpoint targeting the 'adj_time_year' parameter. This is a parameter used for adjusting the system time, but it can be manipulated to include a shell command. VulnCheck warns that the current attacks are similar to those targeting CVE-2019-12168, a similar flaw through the apply.cgi endpoint, but which performs code injection through the "ping_ip" parameter. VulnCheck shared a sample payload that creates a reverse shell to an attacker's computer, giving them full remote access to the routers. After the device's compromise, the attackers may modify its configuration files for persistence, explore the network for other devices to pivot to, and generally escalate the attack. Censys reports that there are currently 15,000 internet-facing Four-Faith routers that could become targets. Users of those devices should ensure they're running the latest firmware version for their model and change the default credentials to something unique and strong (long). VulnCheck has also shared a Suricata rule to detect CVE-2024-12856 exploitation attempts and block them in time. Finally, users should contact their Four-Faith sales representative or customer support agent to request advice on how to mitigate CVE-2024-12856.
Daily Brief Summary
Threat actors are utilizing a remote command injection vulnerability in Four-Faith routers, identified as CVE-2024-12856, to create reverse shells.
This vulnerability affects certain router models used primarily in critical sectors including energy, utilities, and transportation.
Hackers gain access through devices often set up with default credentials, making them susceptible to brute force attacks.
The exploitation involves sending a malicious HTTP POST request which manipulates router settings and establishes a reverse shell.
Compromised routers potentially allow attackers to modify configurations, pivot to other network devices, and escalate privileges for further attacks.
Approximately 15,000 internet-facing Four-Faith routers are at risk worldwide, per a Censys report.
Four-Faith has been notified of the ongoing exploitation, though information on patches or affected firmware remains unclear.
Recommendations for mitigating risks include updating firmware, changing default credentials, and implementing detections via shared Suricata rules.