CVE-2024-22064

Description

ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the user session informations using the keys may be leaked.

CVSS v3.1 Score

8.3

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness Type (CWE)

CWE-1051 CWE-1051

CWE-665 CWE-665

Affected Products

Vendor	Product	Versions
zte	zxun-epdg	< 5.20.20

References

Advisories & Patches

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035524 https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035524

Frequently Asked Questions

What is CVE-2024-22064? +

ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the user session informations using the keys may be leaked. It has a CVSS v3.1 base score of 8.3 (HIGH).

How severe is CVE-2024-22064? +

CVE-2024-22064 has a CVSS v3.1 score of 8.3 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-22064? +

CVE-2024-22064 affects products from zte, specifically: zxun-epdg. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-22064? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-10119 9.8

The wireless router WRTM326 from SECOM does not properly validate a specific parameter. An unauthenticated remote attacker could execute arbitrary …

CVE-2025-46579 8.4

There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and …

CVE-2025-46580 7.7

There is a code-related vulnerability in the GoldenDB database product. Attackers can access system tables to disrupt the normal operation …

CVE-2024-22063 7.6

The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability …

CVE-2024-22066 7.5

There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated attacker could …

CVE-2023-25646 7.1

There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common …