CVE-2024-45416

Katalog CVE

CVSS 8.1 · High EPSS 0,56%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere. Skor CVSS 3.1 8.1 (High) menurut CISA ADP.

Deskripsi (NVD)

The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory /var/lua_session, the function iterates on all files in this directory and executes them using the function dofile without any validation if it is a valid session file or not. An attacker who is able to write a malicious file in the sessions directory can get RCE as root.

Rincian

Terbit di NVD

16 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/