LiveActive security incident?Get immediate response
CVE Record

CVE-2020-15344: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API.

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Zyxel CloudCNM SecuManager API in versions 3.1.0 and 3.1.1 was reported as accessible without login. Because the API name indicates it returns a user ID and key, exposure could support unauthorized access to sensitive management data. The bundle does not provide CVSS, CWE, or confirmed exploitation evidence.

Executive priority

Prioritize inventory and containment if Zyxel CloudCNM SecuManager is present. A management platform exposing key-related API data without authentication can create disproportionate operational risk, even though public severity scoring and exploitation evidence are incomplete.

Technical view

CVE-2020-15344 describes an unauthenticated zy_get_user_id_and_key API in Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1. The public record does not include CVSS, CWE mapping, or detailed impact. Treat internet-reachable or broadly reachable SecuManager instances as higher risk until vendor guidance is verified.

Likely exposure

Exposure is limited to environments running Zyxel CloudCNM SecuManager 3.1.0 or 3.1.1. Risk is greatest where the SecuManager web/API interface is reachable from the internet or untrusted networks. The bundle does not identify other affected products or versions.

Exploitation context

The bundle marks CISA KEV as false and provides no cited source confirming active exploitation. A researcher disclosure is referenced, but the provided data does not establish real-world exploitation, weaponization status, or exploit prevalence.

Researcher notes

The CVE entry is sparse: no CVSS, CWE, CPE, or detailed affected configuration is provided in the bundle. Analysis should stay bounded to CloudCNM SecuManager 3.1.0 and 3.1.1 and validate remediation against Zyxel’s advisory rather than assuming fixes.

Mitigation direction

  • Identify any CloudCNM SecuManager 3.1.0 or 3.1.1 deployments.
  • Review Zyxel’s advisory for supported fixes or replacement guidance.
  • Restrict SecuManager access to trusted administrative networks only.
  • Block public internet access to the management interface.
  • Monitor logs for unauthenticated requests to the affected API.

Validation and detection

  • Confirm installed CloudCNM SecuManager version numbers.
  • Check network exposure of SecuManager web/API endpoints.
  • Review access logs for requests to zy_get_user_id_and_key.
  • Verify compensating controls restrict unauthenticated management access.
  • Document remediation status against Zyxel’s published advisory.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-15344 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.