Description

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is responsible for decrypting RSA encrypted ciphertext, the encrypted data is supplied base64 encoded. The decoded ciphertext is stored on the stack without checking its length. An unauthenticated attacker can get RCE as root by exploiting this vulnerability.

INFO

Published Date :

2024-09-16T00:00:00.000Z

Last Modified :

2024-09-18T15:21:25.704Z

Source :

mitre
AFFECTED PRODUCTS

The following products are affected by CVE-2024-45414 vulnerability.

Vendors Products
Zte
  • Zxhn E1600 Firmware
  • Zxhn E2603 Firmware
  • Zxhn E2615 Firmware
  • Zxhn E2618 Firmware
  • Zxhn E500 Firmware
  • Zxhn H108n Firmware
  • Zxhn H168a Firmware
  • Zxhn H168n Firmware
  • Zxhn H338a Firmware
  • Zxhn Z500 Firmware
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-45414.

URL Resource
https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact