CVE-2020-15332: Cleartext Storage of Sensitive Information

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions...

CVE-2020-15333: Improper Neutralization of Special Elements used in an SQL Command

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select from Administratorusers" and "select from Usersusers" requests...

CVE-2020-15336: Missing Authentication for Critical Function

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests...

CVE-2020-15345: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zygetinstancesforupdate API...

CVE-2020-15326: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem...

CVE-2020-15346: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key...

CVE-2020-15347: Insufficiently Protected Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account...

CVE-2020-15328: Incorrect Permission Assignment for Critical Resource

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions...

PT-2020-14363 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns the use of ZODB storage without authentication in Zyxel CloudCNM SecuManager. Recommendations: For versions 3.1.0 and 3.1.1, consider implementing...

PT-2020-14371 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to the use of GET request method with sensitive query strings for /registerCpe requests. This can potentially expose sensitive information...

PT-2020-6822 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to the implementation of the CPE WAN Management Protocol TR-069 in the Zyxel CloudCNM SecuManager software, which uses hardcoded credentials when handli...