294 matches found
CVE-2020-15340
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/defaultaxess/axess/TR69/Handlers/turbolink/sshkeys/idrsa SSH key...
CVE-2020-15340
Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 are affected by a hardcoded SSH key located at opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa. The issue arises from embedding credentials used in TR-069 handling, enabling potential unauthorized access if exploite...
CVE-2020-15341
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated updateallrealmlicense API...
CVE-2020-15341
CVE-2020-15341 affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The vulnerability is an unauthenticated access issue in the update_all_realm_license API, enabling potential unauthorized operations. Public sources in the connected documents confirm an unauthenticated endpoint as the ro...
CVE-2020-15342
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zyinstalluser API...
CVE-2020-15342
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 expose an unauthenticated API endpoint, zy_install_user, enabling unauthorized access. Root cause: unauthenticated API call in the system. Impact: unauthorized actions on SecuManager (per the PT Security entry; no explicit CVSS details in provided docs)....
CVE-2020-15343
The CVE-2020-15343 entry concerns Zyxel CloudCNM SecuManager, with affected versions 3.1.0 and 3.1.1. The root cause is an unauthenticated API endpoint (zy_install_user_key) that allows unauthorized access. Documented impact indicates unauthorized use of the API, which could enable configuration ...
CVE-2020-15343
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zyinstalluserkey API...
CVE-2020-15344
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zygetuseridandkey API...
CVE-2020-15344
CVE-2020-15344 affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The issue is an unauthenticated API endpoint, zy_get_user_id_and_key, which can be reached without authentication. Impact is defined in sources as a potential information exposure (user id and key). No exploit details are...
CVE-2020-15345
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zygetinstancesforupdate API...
CVE-2020-15345
CVE-2020-15345 affects Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1, due to an unauthenticated zy_get_instances_for_update API endpoint. The vulnerability arises from an exposed API that can be accessed without authentication, enabling potential unauthorized access, with CVSSv3.1 base score 5.3 (Ne...
CVE-2020-15346
CVE-2020-15346 concerns Zyxel CloudCNM SecuManager 3.1.0–3.1.1. Public documentation in PT-2020-14379 identifies a vulnerability in the "/live/GLOBALS" API endpoint that exposes the CLOUDCNM key. There are no exploitation details in the provided sources. The affected software is Zyxel CloudCNM Se...
CVE-2020-15346
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key...
CVE-2020-15347
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account...
CVE-2020-15347
The CVE concerns Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 where the axiros account uses a hardcoded password (q6xV4aW8bQ4cfD-b), enabling remote attackers to obtain full access to affected devices. Root cause: insufficient credential protection in the SecuManager software leads to cred...
CVE-2020-15325
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication...
CVE-2020-15325
The CVE refers to Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1, where a hardcoded Erlang cookie for ejabberd replication creates a risk of unauthorized access. Related connected sources (PT-2020-6772) also note unencrypted storage of credentials, increasing exposure. Affected versions are 3.1.0–3.1...
CVE-2020-15326
CVE-2020-15326 affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The root cause is a hardcoded Ejabberd certificate stored in the ejabberd.pem file, creating a trust-management weakness. Public sources in the connected documents consistently describe this issue as a hardcoded certifica...