Design/Logic Flaw

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select from Administratorusers" and "select from Usersusers" requests...

Hardcoded credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem...

Design/Logic Flaw

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions...

Default credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions...

Hardcoded credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTHSECRETKEY in /opt/axess/etc/default/axess...

Cross site request forgery (csrf)

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests...

Hardcoded credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/defaultaxess/axess/TR69/Handlers/turbolink/sshkeys/idrsa SSH key...

Code injection

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zygetinstancesforupdate API...

Authentication flaw

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication...

Code injection

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated updateallrealmlicense API...

Code injection

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zygetuseridandkey API...

Cross site request forgery (csrf)

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests...

Design/Logic Flaw

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions...

Code injection

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zyinstalluserkey API...

Code injection

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key...

Zyxel CloudCNM SecuManager 安全漏洞

Zyxel CloudCNM SecuManager is a set of network management software from China Hopkins Zyxel. The software supports centralized control, device management and intelligent monitoring. A security vulnerability exists in Zyxel CloudCNM SecuManager version 3.1.0 and 3.1.1, which originates from a...

Zyxel CloudCNM SecuManager SQL注入漏洞

Zyxel CloudCNM SecuManager is a set of network management software from Taiwan, China-based Zyxel. The software supports centralized control, device management and intelligent monitoring. A SQL injection vulnerability exists in Zyxel CloudCNM SecuManager version 3.1.0 and 3.1.1. An attacker can...

Zyxel CloudCNM SecuManager 跨站脚本漏洞

Zyxel CloudCNM SecuManager is a set of network management software from Taiwan, China-based Zyxel. The software supports centralized control, device management and intelligent monitoring. A cross-site scripting vulnerability exists in Zyxel CloudCNM SecuManager version 3.1.0 and 3.1.1, which...

Zyxel CloudCNM SecuManager 安全漏洞

Zyxel CloudCNM SecuManager is a set of network management software from Taiwan, China-based Zyxel. The software supports centralized control, device management and intelligent monitoring. A security vulnerability exists in Zyxel CloudCNM SecuManager version 3.1.0 and 3.1.1, which originates from ...

Zyxel CloudCNM SecuManager 安全漏洞

Zyxel ZyXEL CloudCNM SecuManager is a network management software from Zyxel, Taiwan, China. requests to gain unauthorized access to the system...