CVE-2024-9644: Authentication Bypass in Four-Faith F3x36 Routers

CVE-2024-9644 is an authentication bypass in Four-Faith F3x36 routers running firmware 2.0.0. The vulnerability resides in the administrative web endpoint 'bapply.cgi': unlike the standard 'apply.cgi' endpoint, it does not enforce authentication before accepting administrative commands. An unauthenticated remote attacker can exploit this alternative channel to modify critical router settings, including network configuration, credentials, and routing tables.

The CVSS score is 9.8, critical severity. NVD published the vulnerability on February 4, 2025. Public signals on GitHub (October 30, 2026) indicate that repositories contain proof-of-concept declarations, confirming interest from researchers and potential attackers. Official patch status from Four-Faith is not reported in available data.

Immediate action: if inventory contains F3x36 devices, identify firmware version and contact Four-Faith for update availability. If patch is unavailable, apply mitigations: block access to bapply.cgi endpoint via perimeter firewall or WAF, restrict administrative access to authorized IP addresses, monitor logs for unauthenticated requests to administrative endpoints. Do not assign critical functions to the router until patching is completed.