PT-2024-19178 · Zte · Zxun-Epdg

Published 2024-05-10 · Updated 2024-07-31 · CVE-2024-22064

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ZTE ZXUN-ePDG product versions up to 5.20.19

Description The ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, uses a set of non-unique cryptographic keys by default configuration when establishing a secure connection with mobile devices. If the set of keys is leaked or cracked, user session information may be compromised.

Recommendations For ZTE ZXUN-ePDG product versions up to 5.20.19, patch the system immediately to prevent potential compromise. As a temporary workaround, consider auditing network access to minimize the risk of exploitation. Restrict access to the system until a patch is applied to prevent system compromise. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Initialization

Weakness Enumeration

CWE-1051

CWE-665

Related Identifiers

CVE-2024-22064

Affected Products

Zxun-Epdg

References · 7

• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035524 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22064 · Security Note
• https://twitter.com/cracbot/status/1791710385130889509 · Twitter Post
• https://t.me/cybersecuritytechnologies/10911 · Telegram Post
• https://twitter.com/cracbot/status/1792072770647716121 · Twitter Post
• https://twitter.com/oktsec/status/1809590509708398855 · Twitter Post