Description
The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory /var/lua_session, the function iterates on all files in this directory and executes them using the function dofile without any validation if it is a valid session file or not. An attacker who is able to write a malicious file in the sessions directory can get RCE as root.
Metrics
CVSS 3.1 8.1/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| zte | zxhn_z500_firmware | V1.0.1.1B2.1000 |
| zte | zxhn_e500_firmware | V1.0.1.1B2.1000 |
| zte | zxhn_h108n_firmware | V2.6.20.ROST12 |
| zte | zxhn_e2615_firmware | V1.0.1 |
| zte | zxhn_e2603_firmware | V1.0.1 |
| zte | zxhn_e2618_firmware | V1.0.0.2B4.3000 |
| zte | zxhn_e1600_firmware | V1.0.0.2B1.1000 |
| zte | zxhn_h338a_firmware | V1.5.0_H3A.1T9P1-o |
| zte | zxhn_h168n_firmware | V3.5.5_CO.1T1 |
| zte | zxhn_h168a_firmware | TTN.1T1_211029 |
References
Timeline
- Published
- Sep 16, 2024
- Last modified
- Jun 17, 2026
- NVD status
- Deferred