CVE-2024-22064
📋 TL;DR
ZTE ZXUN-ePDG products use non-unique cryptographic keys by default when establishing IKE secure connections with mobile devices over the internet. If these keys are compromised, attackers can decrypt and access user session information. This affects all ZTE ZXUN-ePDG deployments with default configurations.
💻 Affected Systems
- ZTE ZXUN-ePDG
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Mass decryption of all VoWifi user sessions, leading to complete compromise of user communications, location tracking, and potential credential theft.
Likely Case
Targeted decryption of specific user sessions, allowing interception of communications and potential session hijacking.
If Mitigated
Limited to internal network attacks if proper segmentation and monitoring are in place.
🎯 Exploit Status
Requires obtaining the non-unique keys through other means before session decryption is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact ZTE for specific patched versions
Vendor Advisory: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035524
Restart Required: Yes
Instructions:
1. Contact ZTE support for security patches. 2. Apply patches according to ZTE documentation. 3. Restart affected ePDG systems. 4. Regenerate all cryptographic keys.
🔧 Temporary Workarounds
Manual Key Regeneration
allManually regenerate unique cryptographic keys for all IKE connections
Specific commands depend on ZTE CLI interface - consult ZTE documentation
Network Segmentation
allIsolate ePDG systems from untrusted networks and implement strict access controls
🧯 If You Can't Patch
- Implement network segmentation to limit exposure
- Enable comprehensive logging and monitoring of IKE connections
🔍 How to Verify
Check if Vulnerable:
Check if IKE cryptographic keys are using default/non-unique values in ZTE configurationCheck Version:
Consult ZTE documentation for version check commands specific to ZXUN-ePDGVerify Fix Applied:
Verify that unique cryptographic keys are generated for each IKE session and old keys are invalidated📡 Detection & Monitoring
Log Indicators:
- Multiple IKE session failures
- Unusual IKE negotiation patterns
- Key exchange anomalies
Network Indicators:
- Unusual IKE traffic patterns
- Multiple connections using same cryptographic material
SIEM Query:
source="zte-epdg" AND (event_type="ike_failure" OR event_type="key_exchange") | stats count by src_ip, dest_ip