PT-2020-14378 · Zyxel · Zyxel Cloudcnm Secumanager

Alexandre Torres + 1 · Published 2020-06-26 · Updated 2022-10-27 · CVE-2020-15345

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1

Description The issue concerns an unauthenticated API endpoint, specifically the "zy get instances for update" API.

Recommendations For versions 3.1.0 and 3.1.1, consider restricting access to the "zy get instances for update" API endpoint to prevent unauthorized access until a patch is available.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2020-15345

Affected Products

Zyxel Cloudcnm Secumanager

References · 4

• 🔥 https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15345 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15345 · Vendor Advisory
• https://zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml · Vendor Advisory