CVE-2020-15345

Vulnerability

The Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 expose an unauthenticated API endpoint zy_get_instances_for_update. This API call requires no authentication or prior knowledge, making it accessible to any attacker who can reach the management interface [1].

Exploitation

An attacker with network access to the SecuManager web interface can directly call zy_get_instances_for_update without any authentication, user interaction, or privileges. No special conditions are required beyond network connectivity [1].

Impact

Successful exploitation allows an unauthenticated remote attacker to retrieve instance-level information from the SecuManager, potentially revealing the managed security gateway inventory and configuration details. This is a confidentiality breach that can aid in further targeted attacks [1].

Mitigation

Zyxel has not released a fixed version for this specific vulnerability in the available references [1]. As a workaround, administrators should restrict network access to the SecuManager’s web interface using a firewall or VLAN segmentation, limiting exposure to trusted networks only [1].