Industrial edge devices are being absorbed into hacker-controlled botnets at an escalating pace. The flaw was tracked as CVE-2024-9643, a critical authentication bypass flaw in Four-Faith F3x36 industrial routers.
The flaw has entered the Mass Exploitation phase as of May 12, 2026, with 139 attacking IPs observed through May 18.
CVE-2024-9643 exists because firmware v2.0.0 of the Four-Faith F3x36 ships with hard-coded administrative credentials embedded in its web management interface.
The flaw classified under CWE-489 (Active Debug Code) and CWE-798 (Use of Hard-coded Credentials).
Hijack Four-Faith Routers for Botnet Operations
An attacker who knows those credentials can craft HTTP requests targeting endpoints such as /Status_Router.asp to obtain full administrator access without any authentication challenge.
The vulnerability is comparable to CVE-2023-32645, a prior flaw documented in the same product line, suggesting a persistent development oversight by the manufacturer.
A public Nuclei template is already circulating, dramatically lowering the barrier to automated mass scanning.
This is not the first time Four-Faith devices have been weaponized. In late 2024, a Mirai botnet variant known exploited a separate zero-day CVE-2024-12856 across F3x24 and F3x36 routers, maintaining approximately 15,000 daily active infected IPs and launching DDoS attacks exceeding 100 Gbps.
More recently, FortiGuard Labs identified the RondoDox botnet, which exploits CVE-2024-12856 alongside TBK DVR flaws, using custom libraries to mimic gaming and VPN traffic to evade detection. CVE-2024-9643 now adds a second high-confidence attack surface on the same devices.
Exploitation Timeline
The timeline tells a concerning story:
- February 4, 2025 — CVE-2024-9643 publicly disclosed
- April 15, 2026 — CrowdSec releases a dedicated detection rule
- April 20, 2026 — First in-the-wild exploitation observed
- May 12, 2026 — CrowdSec reclassifies activity as Mass Exploitation
- May 18, 2026 — 139 unique attacking IPs recorded
That escalation from first detection to mass exploitation in under 30 days signals attackers are operationalizing this flaw at scale, not merely probing opportunistically.
CrowdSec telemetry shows 76% of observed attacker objectives align with infrastructure takeover.
Commerce organizations represent the largest share of impacted environments, consistent with attackers seeking durable, low-profile edge devices they can fold into botnets, proxy traffic through, or use as footholds for deeper intrusion.
Attacking sources span the United Kingdom, Germany, the United States, and the Netherlands, a geographic spread consistent with automated campaigns rather than targeted intrusion sets.
Over 15,000 internet-facing Four-Faith devices have been identified on Censys, indicating the potential attack surface remains massive.
Mitigation
- Apply firmware updates immediately — a CVSS score of 9.8, combined with publicly available exploit tooling, makes any delay unacceptable.
- Restrict management interfaces from public internet exposure; place router admin panels behind VPN or firewall ACLs
- Deploy the CrowdSec Security Engine to detect exploitation attempts targeting exposed services and administration interfaces.
- Audit for related CVEs — CVE-2024-12856 (CVSS 7.2) and CVE-2024-9644 affect the same F3x36 firmware and are already being weaponized by the RondoDox and Mirai-variant botnets
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
.
