by Kastro
Paper/Archive/CVE-2024-45414

CVE-2024-45414

zte zxhn_z500_firmware — The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function.

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 41.7.417 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is responsible for decrypting RSA encrypted ciphertext, the encrypted data is supplied base64 encoded. The decoded ciphertext is stored on the stack without checking its length. An unauthenticated attacker can get RCE as root by exploiting this vulnerability.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
zxhn_z500_firmwareV1.0.1.1B2.1000–CISA-ADP
zxhn_e500_firmwareV1.0.1.1B2.1000–CISA-ADP
zxhn_h108n_firmwareV2.6.20.ROST12–CISA-ADP
zxhn_e2615_firmwareV1.0.1–CISA-ADP
zxhn_e2603_firmwareV1.0.1–CISA-ADP
zxhn_e2618_firmwareV1.0.0.2B4.3000–CISA-ADP
zxhn_e1600_firmwareV1.0.0.2B1.1000–CISA-ADP
zxhn_h338a_firmwareV1.5.0_H3A.1T9P1-o–CISA-ADP
zxhn_h168n_firmwareV3.5.5_CO.1T1–CISA-ADP
zxhn_h168a_firmwareTTN.1T1_211029–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory