ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the user session informations using the keys may be leaked.
The product initializes data using hard-coded values that act as network resource identifiers.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Zxun-epdg | Zte | * | 5.20.20 (excluding) |
This issue can prevent the product from running reliably, e.g. if it runs in an environment does not use the hard-coded network resource identifiers. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.