PT-2020-14376 · Zyxel · Zyxel Cloudcnm Secumanager

Alexandre Torres + 2 · Published 2020-06-26 · Updated 2022-10-27 · CVE-2020-15343

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1

Description The issue concerns an unauthenticated API, specifically the "zy install user key" API endpoint. This allows for unauthorized access.

Recommendations For versions 3.1.0 and 3.1.1, consider disabling the zy install user key API endpoint until a patch is available. Restrict access to the zy install user key API endpoint to minimize the risk of exploitation.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2020-15343

Affected Products

Zyxel Cloudcnm Secumanager

References · 5

• 🔥 https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-15343 · Vendor Advisory
• https://zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15343 · Security Note
• https://t.me/cibsecurity/50692 · Telegram Post