CVE-2024-45414

Executive Summary

CVE-2024-45414 is a critical, unauthenticated remote code execution (RCE) vulnerability affecting the HTTPD binary in multiple ZTE router models. The flaw resides in the webPrivateDecrypt function, which handles RSA decryption of base64-encoded ciphertext. Due to a lack of length validation, a stack-based buffer overflow occurs when the decoded ciphertext is copied onto the stack. An unauthenticated attacker can exploit this to achieve RCE as root, gaining full control over the device. The vulnerability has a CVSS score of 0.0 in the NVD data, but based on the description and impact, it is assessed as critical (CVSS 9.8). No public exploit code or proof-of-concept is available at this time, and no patch has been released by ZTE.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in ZTE's proprietary HTTPD binary, affecting the device's embedded software supply chain. Users are advised to monitor ZTE's official channels for firmware updates and consider replacing affected devices if no patch is provided.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated exploitation.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full device compromise leads to data exposure.
• Integrity Impact: High (I:H) – Attacker can modify system files and configurations.
• Availability Impact: High (A:H) – Denial of service or device bricking possible.

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution as root, making it highly attractive for botnets, ransomware, and targeted attacks.

Deep Dive & Mechanics

The vulnerability exists in the webPrivateDecrypt function within the HTTPD binary of ZTE routers. This function is responsible for decrypting RSA-encrypted ciphertext that is supplied base64-encoded. The process flow is as follows:

1. Input Reception: The HTTPD server receives a POST request containing base64-encoded RSA ciphertext.
2. Base64 Decoding: The ciphertext is decoded from base64 to raw binary.
3. RSA Decryption: The decoded data is decrypted using the device's RSA private key.
4. Stack Buffer Overflow: The decrypted plaintext is then copied into a fixed-size stack buffer without any length check. If the decrypted data exceeds the buffer size, it overflows adjacent stack memory.

An attacker can craft a malicious RSA ciphertext that, when decrypted, produces a payload larger than the stack buffer. This overwrites the return address and other critical stack data, allowing the attacker to redirect execution to shellcode. Since the HTTPD runs with root privileges, the attacker gains full control over the router.

Key Technical Details:

• Vulnerable Function: webPrivateDecrypt
• Vulnerable Component: HTTPD binary
• Attack Vector: Unauthenticated network requests
• Impact: Remote code execution as root

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, based on the vulnerability description, the patched code would likely include a length check before copying the decrypted data into the stack buffer. For example:

Vulnerable Code (Conceptual):

void webPrivateDecrypt(char *base64_input) {
    char decrypted[256]; // Fixed-size stack buffer
    char *raw = base64_decode(base64_input);
    rsa_decrypt(raw, decrypted); // No length check
    // ... process decrypted data
}

Patched Code (Conceptual):

void webPrivateDecrypt(char *base64_input) {
    char decrypted[256]; // Fixed-size stack buffer
    char *raw = base64_decode(base64_input);
    int len = rsa_decrypt_len(raw);
    if (len > sizeof(decrypted)) {
        // Error handling, reject request
        return;
    }
    rsa_decrypt(raw, decrypted, len); // Length-checked copy
    // ... process decrypted data
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable ZTE router (model unknown, but multiple models affected).
• Network access to the router's HTTP management interface (typically port 80 or 443).
• Knowledge of the RSA public key (if embedded in firmware) or ability to derive it.

Exploitation Steps:

1. Reconnaissance: Identify ZTE routers via Shodan or network scanning. Look for HTTP servers with ZTE branding.
2. Craft Payload: Create a malicious RSA ciphertext that, when decrypted, produces a payload larger than the stack buffer. The payload should include shellcode to spawn a reverse shell or execute arbitrary commands.
3. Send Request: Send a POST request to the vulnerable endpoint (e.g., /cgi-bin/... or similar) with the base64-encoded ciphertext.
4. Trigger Overflow: The HTTPD processes the request, decrypts the ciphertext, and overflows the stack buffer, executing the shellcode.
5. Gain Access: Receive a reverse shell as root on the router.

Example Request (Conceptual):

POST /cgi-bin/private_decrypt HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: <length>

ciphertext=<base64_encoded_malicious_payload>

Note: No public exploit code is available. This is a conceptual guide.

Blue Team (Defense & Detection)

Detection Strategies:

• Network Monitoring: Monitor for unusually large POST requests to the router's management interface, especially those containing base64-encoded data.
• Anomaly Detection: Look for RSA decryption operations that result in abnormally large plaintext outputs.
• Stack Canaries: If the firmware supports stack canaries, they may detect the overflow and crash the process, preventing exploitation.
• WAF Rules: Deploy a web application firewall (WAF) to block requests with excessively long ciphertext parameters.

Honeypot Deployment:

• Set up a honeypot mimicking a ZTE router to capture exploitation attempts and analyze attacker techniques.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/private_decrypt or similar endpoints with large base64-encoded payloads.
• Unusual outbound connections from the router to external IPs (reverse shell traffic).
• Anomalous RSA decryption operations in HTTPD logs.

Host IOCs:

• Unexpected processes running as root on the router.
• Modified system binaries or configuration files.
• Presence of shellcode or backdoor binaries in memory or filesystem.

File IOCs:

• Suspicious files in /tmp or /var directories.
• Modified HTTPD binary or configuration.

Detection Engineering

YARA Rule

rule CVE_2024_45414_ZTE_Router_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-45414 in ZTE routers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45414"
    strings:
        $s1 = "webPrivateDecrypt" ascii wide nocase
        $s2 = "RSA" ascii wide nocase
        $s3 = "base64" ascii wide nocase
        $hex1 = { 55 48 89 E5 48 81 EC ?? ?? ?? ?? } // Stack frame setup
    condition:
        all of ($s*) and $hex1
}

Sigma Rule

title: CVE-2024-45414 ZTE Router RCE Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests with large base64-encoded payloads targeting ZTE router management interfaces
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45414
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'cgi-bin'
        cs-uri-query|contains: 'decrypt'
        sc-bytes|>=: 10000
    condition: selection
falsepositives:
    - Legitimate large firmware updates (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45414 ZTE Router RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"cgi-bin"; http_uri; content:"decrypt"; http_uri; pcre:"/ciphertext=[A-Za-z0-9+/]{1000,}/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Devices: Disconnect vulnerable ZTE routers from the internet and place them behind a firewall.
2. Disable Remote Management: If not required, disable remote management (WAN-side access) to the router's web interface.
3. Monitor for Updates: Regularly check ZTE's official website and security advisories for firmware patches.

Long-Term Solutions:

• Replace Devices: If ZTE does not release a patch, consider replacing affected routers with models from vendors with better security track records.
• Network Segmentation: Place routers in a separate VLAN with strict access controls.
• Implement WAF: Deploy a web application firewall to filter malicious requests.

Patch Details: No patch available. Users should monitor ZTE's security page at https://www.zte.com.cn/global/about/security for updates.

Valters IT