deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-15632
Published: 2020-12-22
Description: Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an empty database on which they can connect with default credentials.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://github.com/odoo/odoo/issues/63700; https://github.com/odoo/odoo/issues/63700
CVE: CVE-2018-15633
Published: 2020-12-22
Description: Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/odoo/odoo/issues/63701; https://github.com/odoo/odoo/issues/63701
CVE: CVE-2018-15634
Published: 2020-12-22
Description: Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/odoo/odoo/issues/63702; https://github.com/odoo/odoo/issues/63702
CVE: CVE-2018-15638
Published: 2020-12-22
Description: Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/odoo/odoo/issues/63703; https://github.com/odoo/odoo/issues/63703
CVE: CVE-2018-15641
Published: 2020-12-22
Description: Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/odoo/odoo/issues/63704; https://github.com/odoo/odoo/issues/63704
CVE: CVE-2018-15645
Published: 2020-12-22
Description: Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-732
References: https://github.com/odoo/odoo/issues/63705; https://github.com/odoo/odoo/issues/63705
CVE: CVE-2019-11781
Published: 2020-12-22
Description: Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/odoo/odoo/issues/63706; https://github.com/odoo/odoo/issues/63706
CVE: CVE-2019-11782
Published: 2020-12-22
Description: Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/odoo/odoo/issues/63707; https://github.com/odoo/odoo/issues/63707
CVE: CVE-2019-11783
Published: 2020-12-22
Description: Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to subscribe to arbitrary mail channels uninvited.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://github.com/odoo/odoo/issues/63708; https://github.com/odoo/odoo/issues/63708
CVE: CVE-2019-11784
Published: 2020-12-22
Description: Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://github.com/odoo/odoo/issues/63709; https://github.com/odoo/odoo/issues/63709
CVE: CVE-2019-11785
Published: 2020-12-22
Description: Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscribe to receive future messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://github.com/odoo/odoo/issues/63710; https://github.com/odoo/odoo/issues/63710
CVE: CVE-2019-11786
Published: 2020-12-22
Description: Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to modify translated terms, which may lead to arbitrary content modification on translatable elements.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/odoo/odoo/issues/63711; https://github.com/odoo/odoo/issues/63711
CVE: CVE-2020-29396
Published: 2020-12-22
Description: A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-267
References: https://github.com/odoo/odoo/issues/63712; https://www.oracle.com/security-alerts/cpujul2022.html; https://github.com/odoo/odoo/issues/63712
CVE: CVE-2020-13557
Published: 2020-12-22
Description: A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1171; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1171
CVE: CVE-2020-13560
Published: 2020-12-22
Description: A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1175; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1175
CVE: CVE-2020-13570
Published: 2020-12-22
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger the reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1181; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1181
CVE: CVE-2020-25106
Published: 2020-12-22
Description: Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://packetstormsecurity.com/files/160666/SUPREMO-4.1.3.2348-Privilege-Escalation.html; https://seclists.org/fulldisclosure/2020/Dec/42; https://www.supremocontrol.com/changelog/
CVE: CVE-2020-13547
Published: 2020-12-22
Description: A type confusion vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger an improper use of an object, resulting in memory corruption and arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-787, CWE-843
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1165; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1165
CVE: CVE-2020-24578
Published: 2020-12-22
Description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious network user to access system folders and download sensitive files (such as the password hash file).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427, CWE-732
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/
CVE: CVE-2020-24579
Published: 2020-12-22
Description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/
CVE: CVE-2020-24580
Published: 2020-12-22
Description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. Lack of authentication functionality allows an attacker to assign a static IP address that was once used by a valid user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/
CVE: CVE-2020-24581
Published: 2020-12-22
Description: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It contains an execute_cmd.cgi feature (that is not reachable via the web user interface) that lets an authenticated user execute Operating System commands.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/
CVE: CVE-2020-14231
Published: 2020-12-22
Description: A vulnerability in the input parameter handling of HCL Client Application Access v9 could potentially be exploited by an authenticated attacker resulting in a stack buffer overflow. This could allow the attacker to crash the program or inject code into the system which would execute with the privileges of the currently logged in user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085882; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085882
CVE: CVE-2020-35608
Published: 2020-12-22
Description: A code execution vulnerability exists in the normal world’s signed code execution functionality of Microsoft Azure Sphere 20.07. A specially crafted AF_PACKET socket can cause a process to create an executable memory mapping with controllable content. An attacker can execute a shellcode that uses the PACKET_MMAP functionality to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-74
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1134; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1134; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1134
CVE: CVE-2020-35609
Published: 2020-12-22
Description: A denial-of-service vulnerability exists in the asynchronous ioctl functionality of Microsoft Azure Sphere 20.05. A sequence of specially crafted ioctl calls can cause a denial of service. An attacker can write shellcode to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1117; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1117; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1117
CVE: CVE-2020-14270
Published: 2020-12-22
Description: HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-755
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085881; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085881
CVE: CVE-2020-14874
Published: 2020-12-22
Description: Vulnerability in the Oracle Cloud Infrastructure Identity and Access Management product of Oracle Cloud Services. Easily exploitable vulnerability allows high privileged attacker with network access to compromise Oracle Cloud Infrastructure Identity and Access Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Cloud Infrastructure Identity and Access Management accessible data as well as unauthorized read access to a subset of Oracle Cloud Infrastructure Identity and Access Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Cloud Infrastructure Identity and Access Management.
CVSS Score: 4.7 (MEDIUM)
References: https://www.oracle.com/security-alerts/oracle-cves-outside-other-oracle-public-documents.html; https://www.oracle.com/security-alerts/oracle-cves-outside-other-oracle-public-documents.html
CVE: CVE-2020-24673
Published: 2020-12-22
Description: In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. This can lead to a loss of confidentiality and data integrity or even affect the product behavior and its availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-24674
Published: 2020-12-22
Description: In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service (DoS) attack, execute arbitrary code, or obtain more privilege than intended on the machines.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285, CWE-863
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-24675
Published: 2020-12-22
Description: In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standalone S+ History server) and ultimately write values to the controlled process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-24676
Published: 2020-12-22
Description: In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged (but authenticated) user could execute arbitrary code and result in privilege escalation, depending on the user that the service runs as.
CVSS Score: 7.8 (HIGH)
CWE: CWE-274
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-24677
Published: 2020-12-22
Description: Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-754, CWE-754
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-24678
Published: 2020-12-22
Description: An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by multiple vulnerabilities such as the possibility to allow remote authenticated users to gain high privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-24679
Published: 2020-12-22
Description: A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-24680
Published: 2020-12-22
Description: In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database.
CVSS Score: 7.0 (HIGH)
CWE: CWE-255, CWE-522
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-24683
Published: 2020-12-22
Description: The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305, CWE-602, CWE-669
References: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-25066
Published: 2020-12-22
Description: A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service (crash/reset) or to possibly execute arbitrary code.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-787
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://treck.com/vulnerability-response-information/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-27336
Published: 2020-12-22
Description: An issue was discovered in Treck IPv6 before 6.0.1.68. Improper input validation in the IPv6 component when handling a packet sent by an unauthenticated remote attacker could result in an out-of-bounds read of up to three bytes via network access.
CVSS Score: 3.7 (LOW)
CWE: CWE-20, CWE-125, CWE-125
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://treck.com/vulnerability-response-information/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-27337
Published: 2020-12-22
Description: An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the IPv6 component allows an unauthenticated remote attacker to cause an Out of Bounds Write, and possibly a Denial of Service via network access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-787, CWE-787
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://treck.com/vulnerability-response-information/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-27338
Published: 2020-12-22
Description: An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the DHCPv6 client component allows an unauthenticated remote attacker to cause an Out of Bounds Read, and possibly a Denial of Service via adjacent network access.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://treck.com/vulnerability-response-information/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-29583
Published: 2020-12-22
Description: Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-522
References: http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf; https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release; https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15