Description

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. This function is an API wrapper for LUA to decrypt RSA encrypted ciphertext, the decrypted data is stored on the stack without checking its length. An authenticated attacker can get RCE as root by exploiting this vulnerability.

INFO

Published Date :

2024-09-16T00:00:00.000Z

Last Modified :

2024-09-18T15:22:15.636Z

Source :

mitre
AFFECTED PRODUCTS

The following products are affected by CVE-2024-45413 vulnerability.

Vendors Products
Zte
  • Zxhn E1600 Firmware
  • Zxhn E2603 Firmware
  • Zxhn E2615 Firmware
  • Zxhn E2618 Firmware
  • Zxhn E500 Firmware
  • Zxhn H108n Firmware
  • Zxhn H168a Firmware
  • Zxhn H168n Firmware
  • Zxhn H338a Firmware
  • Zxhn Z500 Firmware
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-45413.

URL Resource
https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact