Products
ZTE routers
- Unknown
Source
cve@mitre.org
Tags
CVE-2024-45416 details
Published : Sept. 16, 2024, 9:15 p.m.
Last Modified : Sept. 16, 2024, 9:15 p.m.
Last Modified : Sept. 16, 2024, 9:15 p.m.
Description
The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory /var/lua_session, the function iterates on all files in this directory and executes them using the function dofile without any validation if it is a valid session file or not. An attacker who is able to write a malicious file in the sessions directory can get RCE as root.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
References
| URL | Source |
|---|---|
| https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/ | cve@mitre.org |
This website uses the NVD API, but is not approved or certified by it.