PT-2020-14375 · Zyxel · Zyxel Cloudcnm Secumanager

Alexandre Torres + 1 · Published 2020-06-26 · Updated 2022-10-27 · CVE-2020-15342

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1

Description The issue concerns an unauthenticated API, specifically the "zy install user" API endpoint. This allows for unauthorized access.

Recommendations For versions 3.1.0 and 3.1.1, consider disabling the zy install user API endpoint until a patch is available to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2020-15342

Affected Products

Zyxel Cloudcnm Secumanager

References · 5

• 🔥 https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html · Exploit
• 🔥 https://zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml · Exploit
• https://osv.dev/vulnerability/CVE-2020-15342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15342 · Security Note
• https://t.me/cibsecurity/50700 · Telegram Post