Local File Inclusion Vulnerability in ZTE Routers' HTTPD Binary
CVE-2024-45416

8.1HIGH

Key Information:

Vendor

ZTE

Status
ZTE Routers
Vendor
CVE Published:
16 September 2024

What is CVE-2024-45416?

A local file inclusion vulnerability exists in the HTTPD binary of multiple ZTE routers, specifically in the session_init function. This flaw arises due to the lack of validation when iterating through files in the /var/lua_session directory, where session -LUA- files are stored. An attacker who manages to upload a malicious file to this directory could exploit this vulnerability, executing the file without proper checks in place, potentially leading to remote code execution with root privileges.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://wr3nchsr.github.io/zte-multiple-routers-httpd-vul...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.