Zyxel Cloud CNM SecuManager Full Access

The vulnerability of the /opt/axess/etc/default/axess software for network device centralized management in Zyxel CloudCNM SecuManager lies in the unencrypted storage of user credentials. Exploiting this vulnerability could allow a malicious actor to gain full access to network devices remotely...

CVE-2020-15330

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APPKEY in /opt/axess/etc/default/axess...

CVE-2020-15317

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree...

CVE-2020-15316

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree...

Hardcoded credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree...

CVE-2020-15317: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree...

CVE-2020-15316: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree...

PT-2020-14353

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a hardcoded ECDSA SSH key for the root account, located within the /opt/axess chroot directory tree. Recommendations For versions 3.1.0 and 3.1.1, consider...

PT-2020-14352

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a hardcoded DSA SSH key for the root account, located within the /opt/axess chroot directory tree. Recommendations For versions 3.1.0 and 3.1.1, update the...

CVE-2020-15332: Cleartext Storage of Sensitive Information

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions...

CVE-2020-15330: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APPKEY in /opt/axess/etc/default/axess...

CVE-2020-15328: Incorrect Permission Assignment for Critical Resource

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions...