CVE-2020-15327

The CVE-2020-15327 issue affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The root cause is the use of ZODB storage without authentication, which can allow remote access to stored data without credentials. Public references align on a trust-management vulnerability leading to potentia...

CVE-2020-15327

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication...

CVE-2020-15328

Zyxel CloudCNM SecuManager (versions 3.1.0–3.1.1) is affected by a permissions weakness in the directory /opt/axess/var/blobstorage/. The issue stems from weak permissions on that path, which could allow unauthorized access to stored data. The available connected sources corroborate the affected ...

CVE-2020-15328

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions...

CVE-2020-15329

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions...

CVE-2020-15329

Zyxel CloudCNM SecuManager, versions 3.1.0 and 3.1.1, contain a vulnerability due to weak permissions on the Data.fs file. The issue stems from insufficient access control on Data.fs, enabling potential unauthorized access. In the connected documents, PT-2020-14365 recommends updating the Data.fs...

CVE-2020-15330

Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 contain a hardcoded APP_KEY in /opt/axess/etc/default/axess. This root cause enables potential unauthorized access or abuse tied to the fixed key, as described in multiple sources. The vulnerability affects the software right in the stated versi...

CVE-2020-15330

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APPKEY in /opt/axess/etc/default/axess...

CVE-2020-15331

Zyxel CloudCNM SecuManager 3.1.0–3.1.1 is affected by a hardcoded OAUTH_SECRET_KEY located at /opt/axess/etc/default/axess. The vulnerability stems from embedding a static secret, enabling potential unauthorized access if the key is exposed. Connected documents confirm the affected software and p...

CVE-2020-15331

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTHSECRETKEY in /opt/axess/etc/default/axess...

CVE-2020-15348

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/deletecpesbyids?cpeids= for eval injection of Python code...

CVE-2020-15348

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/deletecpesbyids?cpeids= for eval injection of Python code...

Code injection

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/deletecpesbyids?cpeids= for eval injection of Python code...

CVE-2020-15348

CVE-2020-15348 affects Zyxel CloudCNM SecuManager (versions 3.1.0 and 3.1.1). The issue is a Python code injection vulnerability exposed through the endpoint live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids=, enabling remote code execution. Multiple connected sources corroborate that ...

CVE-2020-15348

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/deletecpesbyids?cpeids= for eval injection of Python code...

PT-2020-14365 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to weak Data.fs permissions in the affected software. Recommendations: For versions 3.1.0 and 3.1.1, update the permissions of the Data.fs file to ensur...

PT-2020-6758 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to insufficient protection of credentials in the Zyxel CloudCNM SecuManager software, which can allow a remote attacker to gain full access to devices o...

PT-2020-14377 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "zy get user id and key" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access...

PT-2020-14368 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue allows escape-sequence injection into the /var/log/axxmpp.log file. This is related to the API endpoint /var/log/axxmpp.log, but specific vulnerable parameters or...

PT-2020-14374 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "update all realm license" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting acce...