CVE-2024-22064
Zte Zxun-Epdg ≤ 5.20.20
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-22064 is a high-severity Initialization with Hard-Coded Network Resource Configuration Data (CWE-1051) vulnerability in Zte Zxun-Epdg. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19662
Vulnerability Data
ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over the internet . If the…
more
set of keys are leaked or cracked, the user session informations using the keys may be leaked.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Documented configuration settings externalize network resource identifiers so they are not hard-coded at initialization.
Developer testing and evaluation directly exercises initialization paths and can reveal missing or incorrect resource setup.
Baseline configurations require externally managed network settings rather than embedding identifiers in code.
Security engineering principles include externalizing configuration data instead of hard-coding network identifiers.
Requiring the system to fail to a known state structurally reduces the chance that uninitialized resources remain reachable.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
ID.RA-01's code/architecture reviews can surface hard-coded network data after the fact (partial forward) but do nothing to stop developers from embedding it during initial design or coding (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development life cycle requires avoiding hard-coded secrets and network identifiers during design and coding.
A.8.26 only requires that security requirements (including those that could address hard-coded network data) be identified and specified during development or acquisition; it does not itself mandate or perform the design change that would remove the hard-coded initializer from first-party code.
Secure system architecture principles discourage embedding network identifiers in code, but the control is broader.
Secure coding standards typically ban hard-coded network resources, yet the control covers many other practices.
Security testing can detect uninitialized variables but does not itself enforce initialization practices.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-665, a class-level weakness. Rules are authored against its narrower children: CWE-770.