What’s Vulnerable › Vulnerabilities
CVE-2024-45416
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-09-16 · updated 2026-06-17
- Weakness: CWE-829
Description
The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory /var/lua_session, the function iterates on all files in this directory and executes them using the function dofile without any validation if it is a valid session file or not. An attacker who is able to write a malicious file in the sessions directory can get RCE as root.
Affected products
- ZTE Zxhn E1600 Firmware: V1.0.0.2B1.1000
- ZTE Zxhn E2603 Firmware: V1.0.1
- ZTE Zxhn E2615 Firmware: V1.0.1
- ZTE Zxhn E2618 Firmware: V1.0.0.2B4.3000
- ZTE Zxhn E500 Firmware: V1.0.1.1B2.1000
- ZXHN H108N: V2.6.20.ROST12
- ZTE Zxhn H168A Firmware: TTN.1T1_211029
- ZXHN H168N: V3.5.5_CO.1T1
- ZTE Zxhn H338A Firmware: V1.5.0_H3A.1T9P1-o
- ZTE Zxhn Z500 Firmware: V1.0.1.1B2.1000
References
Get alerted when CVE-2024-45416 or the next vulnerability affects your stack