PT-2020-14376
CVE-2020-15343
·
Published
2020-06-26
·
Updated
2022-10-27
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1
Description
The issue concerns an unauthenticated API, specifically the "zy install user key" API endpoint. This allows for unauthorized access.
Recommendations
For versions 3.1.0 and 3.1.1, consider disabling the
zy install user key API endpoint until a patch is available.
Restrict access to the zy install user key API endpoint to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾