CVE-2020-15325

Vulnerability

Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 include a hardcoded Erlang cookie used for ejabberd replication [1]. This cookie is intended to authenticate communication between Erlang nodes, but because it is static and publicly known, any remote attacker can use it to authenticate to the ejabberd service.

Exploitation

An attacker with network access to the ejabberd service can use the hardcoded Erlang cookie to establish an authenticated Erlang connection to the target node [1]. No prior authentication or user interaction is required; the attacker only needs to know the cookie value, which is embedded in the software.

Impact

Successful exploitation allows the attacker to connect to the ejabberd service as an authenticated node. This can lead to unauthorized access to the management system, potentially enabling further compromise of the CloudCNM SecuManager appliance [1].

Mitigation

The available reference does not specify a fixed version or workaround [1]. Users should monitor Zyxel's security advisories for an update that addresses this issue. If no patch is available, consider restricting network access to the ejabberd service.