PT-2020-14368 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue allows escape-sequence injection into the /var/log/axxmpp.log file. This is related to the API endpoint /var/log/axxmpp.log, but specific vulnerable parameters or...

PT-2020-6757 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to weak permissions of the /opt/axess/etc/default/axess file in the Zyxel CloudCNM SecuManager software, which is used for centralized device management...

PT-2020-14376 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API, specifically the "zy install user key" API endpoint. This allows for unauthorized access. Recommendations: For versions 3.1.0 and...

CVE-2020-15330: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APPKEY in /opt/axess/etc/default/axess...

PT-2020-14374 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "update all realm license" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting acce...

PT-2020-14377 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "zy get user id and key" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access...

CVE-2020-15335: Missing Authentication for Critical Function

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests...

CVE-2020-15340: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/defaultaxess/axess/TR69/Handlers/turbolink/sshkeys/idrsa SSH key...

CVE-2020-15329: Incorrect Permission Assignment for Critical Resource

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions...

CVE-2020-15348: Improper Control of Generation of Code

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/deletecpesbyids?cpeids= for eval injection of Python code...

CVE-2020-15338: Missing Authorization

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests...

PT-2020-14367 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns a hardcoded OAUTH SECRET KEY located in /opt/axess/etc/default/axess. Recommendations: For versions 3.1.0 and 3.1.1, consider changing the hardcoded OAUTH...

PT-2020-14365 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to weak Data.fs permissions in the affected software. Recommendations: For versions 3.1.0 and 3.1.1, update the permissions of the Data.fs file to ensur...

CVE-2020-15343: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zyinstalluserkey API...

CVE-2020-15344: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zygetuseridandkey API...

CVE-2020-15342: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zyinstalluser API...

CVE-2020-15325: Cleartext Storage of Sensitive Information

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication...

CVE-2020-15331: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTHSECRETKEY in /opt/axess/etc/default/axess...

CVE-2020-15334: Undefined Security Weakness

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows escape-sequence injection into the /var/log/axxmpp.log file...

CVE-2020-15337: Missing Authorization

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests...