CVE-2024-22064

CVE-2024-22064 describes a vulnerability in the ZTE ZXUN-ePDG product, a network node for VoWifi systems. The flaw stems from the default use of non-unique cryptographic keys during IKE secure connection establishment with mobile devices. This could lead to the leakage of user session information if these keys are compromised. The vulnerability has a CVSS score of 6.5 (Medium), indicating it can be exploited with low attack complexity over an adjacent network without user interaction, potentially resulting in high confidentiality impact. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 37/100. Currently, there is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting low public awareness and attention.