CVE-2020-15347

The CVE concerns Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 where the axiros account uses a hardcoded password (q6xV4aW8bQ4cfD-b), enabling remote attackers to obtain full access to affected devices. Root cause: insufficient credential protection in the SecuManager software leads to cred...

CVE-2020-15325

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication...

CVE-2020-15325

The CVE refers to Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1, where a hardcoded Erlang cookie for ejabberd replication creates a risk of unauthorized access. Related connected sources (PT-2020-6772) also note unencrypted storage of credentials, increasing exposure. Affected versions are 3.1.0–3.1...

CVE-2020-15326

CVE-2020-15326 affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The root cause is a hardcoded Ejabberd certificate stored in the ejabberd.pem file, creating a trust-management weakness. Public sources in the connected documents consistently describe this issue as a hardcoded certifica...

CVE-2020-15326

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem...

CVE-2020-15327

The CVE-2020-15327 issue affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The root cause is the use of ZODB storage without authentication, which can allow remote access to stored data without credentials. Public references align on a trust-management vulnerability leading to potentia...

CVE-2020-15327

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication...

CVE-2020-15328

Zyxel CloudCNM SecuManager (versions 3.1.0–3.1.1) is affected by a permissions weakness in the directory /opt/axess/var/blobstorage/. The issue stems from weak permissions on that path, which could allow unauthorized access to stored data. The available connected sources corroborate the affected ...

CVE-2020-15328

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions...

CVE-2020-15329

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions...

CVE-2020-15329

Zyxel CloudCNM SecuManager, versions 3.1.0 and 3.1.1, contain a vulnerability due to weak permissions on the Data.fs file. The issue stems from insufficient access control on Data.fs, enabling potential unauthorized access. In the connected documents, PT-2020-14365 recommends updating the Data.fs...

CVE-2020-15330

Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 contain a hardcoded APP_KEY in /opt/axess/etc/default/axess. This root cause enables potential unauthorized access or abuse tied to the fixed key, as described in multiple sources. The vulnerability affects the software right in the stated versi...

CVE-2020-15330

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APPKEY in /opt/axess/etc/default/axess...

CVE-2020-15331

Zyxel CloudCNM SecuManager 3.1.0–3.1.1 is affected by a hardcoded OAUTH_SECRET_KEY located at /opt/axess/etc/default/axess. The vulnerability stems from embedding a static secret, enabling potential unauthorized access if the key is exposed. Connected documents confirm the affected software and p...

CVE-2020-15331

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTHSECRETKEY in /opt/axess/etc/default/axess...

CVE-2020-15348

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/deletecpesbyids?cpeids= for eval injection of Python code...

Code injection

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/deletecpesbyids?cpeids= for eval injection of Python code...

CVE-2020-15348

CVE-2020-15348 affects Zyxel CloudCNM SecuManager (versions 3.1.0 and 3.1.1). The issue is a Python code injection vulnerability exposed through the endpoint live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids=, enabling remote code execution. Multiple connected sources corroborate that ...

CVE-2020-15348

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/deletecpesbyids?cpeids= for eval injection of Python code...

PT-2020-6758 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to insufficient protection of credentials in the Zyxel CloudCNM SecuManager software, which can allow a remote attacker to gain full access to devices o...