CVE-2020-15320

Vulnerability

CVE-2020-15320 describes a hardcoded password in Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The MySQL database contains a backdoor root account with the password "axiros" [1]. This issue affects the MySQL service and is part of a larger set of vulnerabilities in these versions.

Exploitation

An attacker with network access to the MySQL service (default port 3306) can log in using the root username and the known password "axiros" [1]. No authentication or additional privileges are required, as the credentials are static and publicly disclosed.

Impact

Successful exploitation grants full administrative access to the MySQL database, allowing an attacker to read, modify, or delete sensitive data such as device configurations, credentials, and logs [1]. This could lead to further compromise of the network management system.

Mitigation

As of the publication date, no patched version has been released by Zyxel. Users should restrict network access to the MySQL service, monitor for unauthorized access, and apply any future updates from the vendor [1].