CVE-2020-15338

Vulnerability

Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 use the GET HTTP method for /cnr requests, passing sensitive data (e.g., authentication tokens or credentials) as query string parameters. This violates best practices as query strings are logged by servers and proxies, and may be visible in browser history or network captures [1].

Exploitation

An attacker with network access to observe HTTP traffic (e.g., via packet capture or access to server logs) can extract the sensitive query string values. No authentication is needed to read the traffic, but the attacker must be in a position to intercept or view the request.

Impact

Successful exploitation allows an attacker to obtain sensitive information such as authentication tokens or credentials, potentially leading to unauthorized access to the CNM SecuManager or associated network devices.

Mitigation

As of the publication date (2020-06-26), no official patch has been announced by Zyxel. Users should consider network-level protection such as using HTTPS with a proper certificate to encrypt traffic, and avoid exposing the management interface to untrusted networks. The exact fix version is not disclosed in the available references [1].