Critical Authentication Bypass in Four-Faith Industrial Routers Driving Global Botnet Expansion

A growing wave of automated cyberattacks is currently targeting Four-Faith industrial cellular routers, leveraging a critical authentication bypass vulnerability identified as CVE-2024-9643. Security researchers have observed that threat actors are rapidly weaponizing this flaw to hijack edge devices, converting them into powerful nodes for large-scale botnet infrastructure.

The Technical Root Cause: Hard-coded Credentials

The vulnerability specifically affects the Four-Faith F3x36 series of industrial routers. It has been assigned a devastating CVSS score of 9.8, reflecting the ease with which it can be exploited. The core of the issue lies in the presence of hard-coded administrative credentials embedded directly within the device’s web-based management interface.

From a technical standpoint, an attacker does not need valid user credentials to gain entry. By transmitting specially crafted HTTP requests to specific management endpoints—most notably /Status_Router.asp—the authentication logic can be bypassed entirely. Once the perimeter is breached, the attacker inherits full administrative privileges, granting them the ability to modify system configurations, exfiltrate sensitive network data, and establish persistent backdoors for long-term access.

From Disclosure to Mass Exploitation: A Rapid Timeline

The lifecycle of this vulnerability demonstrates how quickly “low-effort” exploits transition from theoretical risks to active global threats. The escalation followed a predictable, yet alarming, pattern:

• February 4, 2025: The vulnerability is publicly disclosed.
• April 15, 2026: Security tools, including CrowdSec, release detection signatures to identify the exploit.
• April 20, 2026: The first successful exploitation attempts are captured in the wild.
• May 12, 2026: The activity is officially classified as “Mass Exploitation.”
• May 18, 2026: Researchers identify 139 unique attacking IP addresses actively participating in the campaign.

Telemetry data from CrowdSec suggests that this is not a targeted espionage campaign, but rather a broad infrastructure grab. Approximately 76% of the observed malicious activity is directly linked to botnet construction, where compromised routers serve as proxy nodes, command-and-control (C2) relays, or initial entry points for deeper network penetration.

Industrial Risk and Geographic Spread

Because these routers are designed for remote connectivity in sectors like logistics, retail, and utilities, they are often deployed in “set-and-forget” environments with minimal real-time monitoring. This makes them ideal targets for attackers looking to build a silent, distributed footprint.

The scanning activity is truly global, with significant clusters of attack traffic originating from the United Kingdom, Germany, the United States, and the Netherlands. This wide distribution is a hallmark of automated, script-driven exploitation rather than human-led, targeted attacks.

For an organization, a compromised Four-Faith F3x36 router represents a total loss of trust at the network edge. An attacker can:

• Intercept Traffic: Monitor or manipulate data flowing between remote sites and the central network.
• Lateral Movement: Use the router as a beachhead to probe and attack internal industrial control systems (ICS).
• Persistent Foothold: Maintain a permanent presence in the network, even if other systems are secured.

Mitigation and Defense Strategies

To protect industrial environments from being absorbed into these botnets, organizations must move beyond passive monitoring and adopt proactive hardening measures:

• Immediate Patching: Prioritize firmware updates from Four-Faith to remediate the hard-coded credential flaw.
• Interface Hardening: Disable web management interfaces on any router exposed directly to the public internet. Use VPNs or secure management tunnels instead.
• Traffic Analysis: Implement robust network monitoring to detect unauthorized configuration changes or unusual outbound traffic patterns.
• Automated Detection: Utilize intrusion detection systems (IDS) and threat intelligence feeds to block known malicious IPs associated with this campaign.

As technical deep-dives from entities like Cisco Talos and VulnCheck continue to emerge, the barrier to entry for attackers remains low. Immediate action is required to secure any exposed industrial edge devices.