Threat actors are actively exploiting a command injection vulnerability, in Four-Faith industrial routers to deploy reverse shells and gain full remote access to affected devices. The flaw tracked as CVE-2024-12856 (CVSS 7.2), impacts router models F3x24 and F3x36, commonly used in critical sectors like energy, transportation, and telecommunications. This OS command injection issue, which requires authentication but is often circumvented due to default credentials, allows attackers to execute arbitrary commands via HTTP POST requests targeting the “/apply.cgi” endpoint and its “adj_time_year” parameter. With approximately 15,000 internet-facing routers at risk, attackers exploit the vulnerability to manipulate device configurations, establish persistence, and escalate attacks within connected networks. The exploitation, observed since November 2024, mimics techniques used for CVE-2019-12168 but employs distinct payloads. VulnCheck discovered the malicious activity and alerted Four-Faith on December 20, 2024, but a security patch remains pending. CTIX analysts urge users to update firmware, change default credentials, and implement Suricata rules to detect and block exploitation attempts while awaiting mitigation guidance from Four-Faith.