ZTE Zxhn z500 Firmware vulnerabilities

5 CVEs affecting ZTE Zxhn z500 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-45416, published 2024-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-6879, published 2020-11-19. Low severity, CVSS 3.5. EPSS: 0.7% chance of exploitation in the next 30 days. Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by…
CVE-2024-45416, published 2024-09-16. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory /var/lua_session, the function iterates…
CVE-2024-45415, published 2024-09-16. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is responsible for validating the checksum of data in post…
CVE-2024-45414, published 2024-09-16. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is responsible for decrypting RSA encrypted ciphertext, the…
CVE-2024-45413, published 2024-09-16. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. This function is an API wrapper for LUA to decrypt RSA encrypted ciphertext, the…