CVE-2020-15319

Vulnerability

Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 contain a hardcoded RSA SSH private key for the root account, stored within the /opt/mysql chroot directory tree [1]. This key is identical across all installations, allowing anyone with access to the key to authenticate as root via SSH to the chroot environment.

Exploitation

An attacker who obtains the publicly disclosed hardcoded private key can perform a man-in-the-middle (MITM) attack against SSH connections to the affected appliance [1]. By impersonating the server, the attacker can intercept and decrypt SSH traffic, or authenticate to the chroot environment as root if SSH access is enabled.

Impact

Successful exploitation enables the attacker to decrypt all SSH communications, potentially exposing sensitive configuration data, credentials, and other management traffic [1]. The attacker may also gain root-level access to the chroot environment, leading to further compromise of the appliance.

Mitigation

No official patch or updated version has been released by Zyxel as of the advisory date [1]. Users should restrict network access to the management interface to trusted hosts only, and consider migrating to a supported alternative if available.