PT-2020-6757 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to weak permissions of the /opt/axess/etc/default/axess file in the Zyxel CloudCNM SecuManager software, which is used for centralized device management...

PT-2020-14364 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to weak permissions in the /opt/axess/var/blobstorage/ directory. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access to the...

PT-2020-14373 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns a XSS vulnerability. It affects the handle campaign script link endpoint, specifically the script name parameter. The estimated number of potentially...

PT-2020-14367 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns a hardcoded OAUTH SECRET KEY located in /opt/axess/etc/default/axess. Recommendations: For versions 3.1.0 and 3.1.1, consider changing the hardcoded OAUTH...

PT-2020-14376 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API, specifically the "zy install user key" API endpoint. This allows for unauthorized access. Recommendations: For versions 3.1.0 and...

PT-2020-14379 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns a /live/GLOBALS API endpoint with the CLOUDCNM key. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access to the /live/GLOBALS API...

PT-2020-14362 · Zyxel +1 · Zyxel Cloudcnm Secumanager +1

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns a hardcoded certificate for Ejabberd, which is located in the ejabberd.pem file. Recommendations: For versions 3.1.0 and 3.1.1, consider removing or...

PT-2020-6771 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to a lack of protection for the SQL query structure in the Zyxel CloudCNM SecuManager software. This can be exploited by a remote attacker to gain...

PT-2020-14371 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to the use of GET request method with sensitive query strings for /registerCpe requests. This can potentially expose sensitive information...

PT-2020-14372 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to the use of GET request method with sensitive query strings for /cnr requests. This could potentially expose sensitive information. Recommendations: F...

PT-2020-14375 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API, specifically the "zy install user" API endpoint. This allows for unauthorized access. Recommendations: For versions 3.1.0 and 3.1....

PT-2020-14378 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "zy get instances for update" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting...

PT-2020-14363 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns the use of ZODB storage without authentication in Zyxel CloudCNM SecuManager. Recommendations: For versions 3.1.0 and 3.1.1, consider implementing...

PT-2020-6822 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to the implementation of the CPE WAN Management Protocol TR-069 in the Zyxel CloudCNM SecuManager software, which uses hardcoded credentials when handli...