This can be exploited to execute arbitrary code on the device or to obtain sensitive information. Zyxel has released Zyxel CloudCNM SecuManager 3.1.1. However, it is recommended to update immediately as there are reports of Zyxel CloudCNM SecuManager 3.1.1 being vulnerable to an SQL injection. If you are using this router for AXxmpp communication and are using the /var/log/axxmpp.log file for debugging purposes, be sure to update immediately to avoid potential security issues.
Summary of Updates
A vulnerability has been discovered in Zyxel CloudCNM SecuManager 3.1.1 that can be exploited to execute arbitrary code on the device or to obtain sensitive information. Zyxel has released Zyxel CloudCNM SecuManager 3.1.1, but it is recommended that you update immediately as there is reports of this being vulnerable to an SQL injection.
If you are using this router for AXxmpp communication and are using the /var/log/axxmpp.log file for debugging purposes, be sure to update immediately to avoid potential security issues
Symantec Security Advisory: CVE-2020-15334
Zyxel has released Zyxel CloudCNM SecuManager 3.1.1, a software update for their router which was released on January 10th, 2020. However, it is discovered that the software update may be vulnerable to an SQL injection attack. If you are using this router for AXxmpp communication and are using the /var/log/axxmpp.log file for debugging purposes, be sure to update immediately to avoid potential security issues.
Symantec Security Advisory: CVE-2020-15334
Step 1: Check if you are vulnerable to SQL injection attack
The first step to you can check if you are vulnerable is by running the following command:
ps -ef |grep zyxel
If it outputs the following line, then your router is vulnerable.
root 2110 1 0 17:27 ? 00:00:00 /usr/bin/zyxelcnm-secumgrd --daemon
root 2142 1084 0 17:27 pts/0 00:00:00 grep zyxel
Otherwise, your router is not vulnerable.
How to Update Zyxel CloudCNM SecuManager 3.1.1
For Windows
Timeline
Published on: 09/29/2022 03:15:00 UTC
Last modified on: 09/29/2022 17:15:00 UTC