Mass Exploitation Alert: Hardcoded Credentials in Four-Faith Industrial Routers (CVE-2024-9643) Hijacked for Botnets

CrowdSec reports that CVE-2024-9643, a critical (CVSS 9.8) authentication-bypass in Four-Faith F3x36 industrial cellular routers — caused by hard-coded administrative credentials — has moved into mass exploitation; attackers using public detection scripts (including a Nuclei template) and broadly distributed scanning are seizing devices to build botnets, pivot into internal networks, and proxy malicious traffic, and organizations are urged to patch firmware, restrict management access from the public internet, and audit outbound edge-device traffic.