CVE-2020-15327

Vulnerability

Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 use ZODB (Zope Object Database) storage that is exposed without any authentication. The database is accessible over the network without requiring credentials [1]. This affects the default configuration, and the software does not enforce authentication on the ZODB interface.

Exploitation

An attacker with network access to the SecuManager's ZODB port can connect to the database directly without any authentication. Since the daemons run as root and there is no default firewall, the database may be reachable from the WAN [1]. No user interaction or special privileges are required.

Impact

Successful exploitation allows an attacker to read and potentially modify the ZODB storage, which contains sensitive configuration data and credentials. This can lead to full compromise of the SecuManager and possibly the managed gateways [1].

Mitigation

Zyxel has not disclosed a specific fix for this vulnerability in the available references. Users should restrict network access to the SecuManager and apply any updates from Zyxel when available. The advisory recommends allowing only trusted hosts to connect to the management interface [1].