CVE-2024-45414

The HTTPD binary in a range of ZTE routers overflows a stack buffer in its webPrivateDecrypt function: it base64-decodes attacker-supplied ciphertext, decrypts it, and copies the result onto the stack without checking the length. An unauthenticated attacker who can reach the web interface gets remote code execution as root — total control of the router, from the outside, with no credentials.

This is the worst-case profile for edge networking gear: no authentication, root-level execution, and a widely shared binary across multiple router models, which means one working exploit generalizes across a large device population. That's precisely what mass-scanning actors build router botnets from, and an unauthenticated stack overflow in exposed HTTPD is a reliable, scriptable takeover once details are public.

Our response centers on exposure and model-level inventory. We identify which ZTE models we run and whether any expose their web management interface to untrusted networks, because that reachability is the entire risk. It's also worth pairing with its sibling in the same binary — an attacker probing one of these router flaws is likely testing the others — so we treat the affected HTTPD as a single surface to get off the public side and patched together.