Description

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is responsible for validating the checksum of data in post request. The checksum is sent encrypted in the request, the function decrypts it and stores the checksum on the stack without validating it. An unauthenticated attacker can get RCE as root by exploiting this vulnerability.

INFO

Published Date :

2024-09-16T00:00:00.000Z

Last Modified :

2024-09-18T15:23:17.587Z

Source :

mitre
AFFECTED PRODUCTS

The following products are affected by CVE-2024-45415 vulnerability.

Vendors Products
Zte
  • Zxhn E1600 Firmware
  • Zxhn E2603 Firmware
  • Zxhn E2615 Firmware
  • Zxhn E2618 Firmware
  • Zxhn E500 Firmware
  • Zxhn H108n Firmware
  • Zxhn H168a Firmware
  • Zxhn H168n Firmware
  • Zxhn H338a Firmware
  • Zxhn Z500 Firmware
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-45415.

URL Resource
https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact