CVE-2024-22064: Configuration error Vulnerability in ZTE ZXUN-ePDG

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-14 · updated 2026-06-17
Weakness: CWE-1051

Description

ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the user session informations using the keys may be leaked.

Affected products

ZTE ZXUN-ePDG: before 5.20.20 — fixed in 5.20.20

How to fix

Upgrade to a fixed version: ZTE ZXUN-ePDG 5.20.20. Check the vendor advisory for mitigations.

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035524
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035524

Get alerted when CVE-2024-22064 or the next vulnerability affects your stack