PT-2020-14374 · Zyxel · Zyxel Cloudcnm Secumanager

Alexandre Torres + 1 · Published 2020-06-26 · Updated 2022-10-27 · CVE-2020-15341

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1

Description The issue concerns an unauthenticated API endpoint, specifically the "update all realm license" API.

Recommendations For versions 3.1.0 and 3.1.1, consider restricting access to the "update all realm license" API endpoint to prevent unauthorized updates.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-15341

Affected Products

Zyxel Cloudcnm Secumanager

References · 4

• 🔥 https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-15341 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15341 · Security Note
• https://zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml · Vendor Advisory