Hackers exploit Four-Faith router flaw to open reverse shells

VulnCheck has reported active exploitation of CVE-2024-12856, a post-auth remote command injection in Four-Faith F3x24/F3x36 routers that attackers exploit by sending crafted POST requests to /apply.cgi (adj_time_year) to spawn reverse shells; roughly 15,000 internet-facing devices may be exposed, and mitigation includes updating firmware, changing default credentials, and deploying the provided Suricata detection rule.