CVE-2024-45415

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is responsible for validating the checksum of data in post request. The checksum is sent encrypted in the request, the function decrypts it and stores the checksum on the stack without validating it. An unauthenticated attacker can get RCE as root by exploiting this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-454168.1The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are storCVE-2024-454175.5Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct CVE-2024-454188.8Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalatioCVE-2024-454197.5Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2024-454206.5Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via CVE-2024-454218.8Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2024-454227.5Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via networCVE-2024-454247.5Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network accessCVE-2024-454256.5Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.CVE-2024-454266.5Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network acceCVE-2024-454296.1Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5CVE-2024-45434.3The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is
CVE-2024-45415: Critical severity, CVSS 9.8 | Vulnix