CVE-2024-45415
About
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is responsible for validating the checksum of data in post request. The checksum is sent encrypted in the request, the function decrypts it and stores the checksum on the stack without validating it. An unauthenticated attacker can get RCE as root by exploiting this vulnerability.
Rainforest analyst review
This is the second stack overflow in the same ZTE router HTTPD binary, this time in check_data_integrity: the function decrypts a checksum sent with a POST request and writes it to the stack without validating its size. As with its companion, an unauthenticated attacker reaching the web interface turns that into root-level remote code execution on the device.
Two unauthenticated overflows in the same binary is a meaningful signal — it suggests the request-handling code was written without length discipline throughout, so defenders should assume the attack surface is broader than any single function. Router HTTPD flaws like this feed botnet recruitment because the payoff (persistent root on an edge device) is generic and the exploitation is cheap once public.
Because this and its sibling live in the same binary, we handle them as one job rather than two tickets: the same inventory of ZTE models, the same check on whether web management is exposed to untrusted networks, and the same urgency to pull those interfaces off the public side. An attacker who has one of these will try the other, so partial remediation isn't remediation; the firmware fix and the exposure fix have to cover both.
References
Related CVEs
Frequently asked questions
What is CVE-2024-45415?
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is responsible for validating the checksum of data in post request. The checksum is sent encrypted in the request, the function decrypts it and stores the checksum on the stack without validating it. An unauthenticated attacker can get RCE as root by exploiting this vulnerability.
How severe is CVE-2024-45415?
CVE-2024-45415 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2024-45415 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
How do I fix CVE-2024-45415?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.