CVE-2020-15344

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zygetuseridandkey API...

CVE-2020-15344

CVE-2020-15344 affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The issue is an unauthenticated API endpoint, zy_get_user_id_and_key, which can be reached without authentication. Impact is defined in sources as a potential information exposure (user id and key). No exploit details are...

CVE-2020-15345

CVE-2020-15345 affects Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1, due to an unauthenticated zy_get_instances_for_update API endpoint. The vulnerability arises from an exposed API that can be accessed without authentication, enabling potential unauthorized access, with CVSSv3.1 base score 5.3 (Ne...

CVE-2020-15345

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zygetinstancesforupdate API...

CVE-2020-15346

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key...

CVE-2020-15346

CVE-2020-15346 concerns Zyxel CloudCNM SecuManager 3.1.0–3.1.1. Public documentation in PT-2020-14379 identifies a vulnerability in the "/live/GLOBALS" API endpoint that exposes the CLOUDCNM key. There are no exploitation details in the provided sources. The affected software is Zyxel CloudCNM Se...

CVE-2020-15347

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account...

CVE-2020-15347

The CVE concerns Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 where the axiros account uses a hardcoded password (q6xV4aW8bQ4cfD-b), enabling remote attackers to obtain full access to affected devices. Root cause: insufficient credential protection in the SecuManager software leads to cred...

CVE-2020-15325

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication...

CVE-2020-15325

The CVE refers to Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1, where a hardcoded Erlang cookie for ejabberd replication creates a risk of unauthorized access. Related connected sources (PT-2020-6772) also note unencrypted storage of credentials, increasing exposure. Affected versions are 3.1.0–3.1...

CVE-2020-15326

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem...

CVE-2020-15326

CVE-2020-15326 affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The root cause is a hardcoded Ejabberd certificate stored in the ejabberd.pem file, creating a trust-management weakness. Public sources in the connected documents consistently describe this issue as a hardcoded certifica...

CVE-2020-15327

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication...

CVE-2020-15327

The CVE-2020-15327 issue affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The root cause is the use of ZODB storage without authentication, which can allow remote access to stored data without credentials. Public references align on a trust-management vulnerability leading to potentia...

CVE-2020-15328

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions...

CVE-2020-15328

Zyxel CloudCNM SecuManager (versions 3.1.0–3.1.1) is affected by a permissions weakness in the directory /opt/axess/var/blobstorage/. The issue stems from weak permissions on that path, which could allow unauthorized access to stored data. The available connected sources corroborate the affected ...

CVE-2020-15329

Zyxel CloudCNM SecuManager, versions 3.1.0 and 3.1.1, contain a vulnerability due to weak permissions on the Data.fs file. The issue stems from insufficient access control on Data.fs, enabling potential unauthorized access. In the connected documents, PT-2020-14365 recommends updating the Data.fs...

CVE-2020-15329

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions...

CVE-2020-15330

Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 contain a hardcoded APP_KEY in /opt/axess/etc/default/axess. This root cause enables potential unauthorized access or abuse tied to the fixed key, as described in multiple sources. The vulnerability affects the software right in the stated versi...

CVE-2020-15330

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APPKEY in /opt/axess/etc/default/axess...