ZTE Zxhn e2603 Firmware vulnerabilities

4 CVEs affecting ZTE Zxhn e2603 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-45416, published 2024-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-45416, published 2024-09-16. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory /var/lua_session, the function iterates…
CVE-2024-45415, published 2024-09-16. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is responsible for validating the checksum of data in post…
CVE-2024-45414, published 2024-09-16. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is responsible for decrypting RSA encrypted ciphertext, the…
CVE-2024-45413, published 2024-09-16. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. This function is an API wrapper for LUA to decrypt RSA encrypted ciphertext, the…