CVE-2020-15316

CVE-2020-15316 affects Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1. The issue is a hardcoded ECDSA SSH key for the root account located in the /opt/axess chroot directory tree, as detailed across multiple sources (NVD, Red Hat advisory, CNVD, CVE records). This creates a potential for unauthorized...

CVE-2020-15313

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account...

CVE-2020-15313

CVE-2020-15313 affects Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1. The connected sources confirm a root‑level issue: a hardcoded ECDSA SSH key stored for the root account, creating a persistent authentication risk. Documented by NVD, Red Hat, CNVD, and CVE records, this is a configuration/credent...

CVE-2020-15312

CVE-2020-15312 affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The root cause is a hardcoded DSA SSH key for the root account, enabling potential unauthorized root access via SSH. Metrics indicate a network exposure with high attack complexity and no user interaction, but with partia...

CVE-2020-15319: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/mysql chroot directory tree...

CVE-2020-15314: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account...

CVE-2020-15318: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree...

CVE-2020-15315: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/axess chroot directory tree...

CVE-2020-15316: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree...

CVE-2020-15312: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account...

CVE-2020-15317: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree...

CVE-2020-15340

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/defaultaxess/axess/TR69/Handlers/turbolink/sshkeys/idrsa SSH key...

CVE-2020-15340

Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 are affected by a hardcoded SSH key located at opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa. The issue arises from embedding credentials used in TR-069 handling, enabling potential unauthorized access if exploite...

CVE-2020-15340: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/defaultaxess/axess/TR69/Handlers/turbolink/sshkeys/idrsa SSH key...

Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Default SSH Key Vulnerability (cisco-sa-20190501-nexus9k-sshkey)

According to its self-reported version, Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode has a Default SSH System Key. An unauthenticated, remote attacker can exploit this, to gain root privileges. Please see the included Cisco BIDs and Cisco Security Advisory for more...

Information Disclosure

kexec-tools is vulnerable to information disclosure. mkdumprd created initrd files with world-readable permissions. A local user could possibly use this flaw to gain access to sensitive information, such as the private SSH key used to authenticate to a remote server when kdump was configured to...

Zyxel CNM SecuManager 3.1.0 / 3.1.1 Hardcoded Keys / XSS / Code Execution Vulnerabilities

Zyxel CNM SecuManager versions 3.1.0 and 3.1.1 suffer from having hard-coded secrets, missing authentication, backdoors, and remote code execution vulnerabilities. Zyxel CNM SecuManager 3.1.0 / 3.1.1 Hardcoded Keys / XSS / Code Execution The HTML version on "Multiple vulnerabilities found in Zyxe...

Zyxel CNM SecuManager 3.1.0 / 3.1.1 Hardcoded Keys / XSS / Code Execution

Hello, Please find a text-only version below sent to security mailing lists. The HTML version on "Multiple vulnerabilities found in Zyxel CNM SecuManager" is posted here: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html === text-version of the advisory ===...

CloudBees Jenkins Mac Plugin Data Falsification Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . Mac Plugin is used in one of...

Missing SSH host key validation in mac

mac 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. mac 1.2.0 validates SSH host keys when connecting to agents...