CVE-2024-45414

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is responsible for decrypting RSA encrypted ciphertext, the encrypted data is supplied base64 encoded. The decoded ciphertext is stored on the stack without checking its length. An unauthenticated attacker can get RCE as root by exploiting this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-454159.8The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is CVE-2024-454168.1The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stor CVE-2024-454175.5Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct CVE-2024-454188.8Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalatio CVE-2024-454197.5Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2024-454206.5Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via CVE-2024-454218.8Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2024-454227.5Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via networ CVE-2024-454247.5Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access CVE-2024-454256.5Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.CVE-2024-454266.5Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network acce CVE-2024-454296.1Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5