Account Discovery Vulnerability in Zyxel CloudCNM SecuManager

CVE-2020-15333

Summary

The Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 are vulnerable to account discovery attacks. By exploiting specific MySQL queries, an attacker can retrieve sensitive user account information from the system. This vulnerability allows unauthorized users to execute 'select * from Administrator_users' and 'select * from Users_users' commands, potentially revealing the details of registered accounts. Organizations using these versions should prioritize remediation to secure their systems against unauthorized access.

References