Zyxel Cloud Cnm Secumanager vulnerabilities

2 CVEs affecting Zyxel Cloud Cnm Secumanager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-15324, published 2020-06-29.

More from Zyxel.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-15348, published 2020-06-26. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids= for eval injection of Python code.
• CVE-2020-15324, published 2020-06-29. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a world-readable axess/opt/axXMPPHandler/config/xmpp_config.py file that stores hardcoded credentials.