Vulnerability Details CVE-2019-12583
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.591
EPSS Ranking 98.1%
CVSS Severity
CVSS v3 Score 9.1
CVSS v2 Score 6.4
References
- https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
- https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml
- https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
- https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml
Products affected by CVE-2019-12583
-
cpe:2.3:h:zyxel:uag2100:-
-
cpe:2.3:h:zyxel:uag4100:-
-
cpe:2.3:h:zyxel:uag5100:-
-
cpe:2.3:h:zyxel:usg1100:-
-
cpe:2.3:h:zyxel:usg110:-
-
cpe:2.3:h:zyxel:usg1900:-
-
cpe:2.3:h:zyxel:usg210:-
-
cpe:2.3:h:zyxel:usg2200-vpn:-
-
cpe:2.3:h:zyxel:usg310:-
-
cpe:2.3:h:zyxel:zywall_1100:-
-
cpe:2.3:h:zyxel:zywall_110:-
-
cpe:2.3:h:zyxel:zywall_310:-
-
cpe:2.3:h:zyxel:zywall_vpn100:-
-
cpe:2.3:h:zyxel:zywall_vpn300:-
-
cpe:2.3:o:zyxel:uag2100_firmware:4.18(aaiz.1)c0
-
cpe:2.3:o:zyxel:uag4100_firmware:4.18(aatd.1)c0
-
cpe:2.3:o:zyxel:uag5100_firmware:4.18(aapn.1)c0
-
cpe:2.3:o:zyxel:usg1100_firmware:4.30
-
cpe:2.3:o:zyxel:usg1100_firmware:4.31
-
cpe:2.3:o:zyxel:usg1100_firmware:4.33(aapk.0)c0
-
cpe:2.3:o:zyxel:usg110_firmware:-
-
cpe:2.3:o:zyxel:usg110_firmware:4.30
-
cpe:2.3:o:zyxel:usg110_firmware:4.31
-
cpe:2.3:o:zyxel:usg110_firmware:4.33(aaph.0)c0
-
cpe:2.3:o:zyxel:usg1900_firmware:4.30
-
cpe:2.3:o:zyxel:usg1900_firmware:4.31
-
cpe:2.3:o:zyxel:usg1900_firmware:4.33(aapl.0)c0
-
cpe:2.3:o:zyxel:usg210_firmware:4.30
-
cpe:2.3:o:zyxel:usg210_firmware:4.31
-
cpe:2.3:o:zyxel:usg210_firmware:4.33(aapi.0)c0
-
cpe:2.3:o:zyxel:usg2200-vpn_firmware:4.25
-
cpe:2.3:o:zyxel:usg2200-vpn_firmware:4.30
-
cpe:2.3:o:zyxel:usg2200-vpn_firmware:4.31
-
cpe:2.3:o:zyxel:usg2200-vpn_firmware:4.33(abae.0)c0
-
cpe:2.3:o:zyxel:usg310_firmware:4.30
-
cpe:2.3:o:zyxel:usg310_firmware:4.31
-
cpe:2.3:o:zyxel:usg310_firmware:4.33(aapj.0)c0
-
cpe:2.3:o:zyxel:zywall_1100_firmware:-
-
cpe:2.3:o:zyxel:zywall_1100_firmware:4.20
-
cpe:2.3:o:zyxel:zywall_1100_firmware:4.31
-
cpe:2.3:o:zyxel:zywall_1100_firmware:4.33(aaac.0)c0
-
cpe:2.3:o:zyxel:zywall_110_firmware:-
-
cpe:2.3:o:zyxel:zywall_110_firmware:4.20
-
cpe:2.3:o:zyxel:zywall_110_firmware:4.31
-
cpe:2.3:o:zyxel:zywall_110_firmware:4.33(aaaa.0)c0
-
cpe:2.3:o:zyxel:zywall_310_firmware:-
-
cpe:2.3:o:zyxel:zywall_310_firmware:4.20
-
cpe:2.3:o:zyxel:zywall_310_firmware:4.31
-
cpe:2.3:o:zyxel:zywall_310_firmware:4.33(aaab.0)c0
-
cpe:2.3:o:zyxel:zywall_vpn100_firmware:10.02(abfv.0)c0
-
cpe:2.3:o:zyxel:zywall_vpn100_firmware:4.20
-
cpe:2.3:o:zyxel:zywall_vpn100_firmware:4.30
-
cpe:2.3:o:zyxel:zywall_vpn100_firmware:4.35
-
cpe:2.3:o:zyxel:zywall_vpn100_firmware:5.00
-
cpe:2.3:o:zyxel:zywall_vpn100_firmware:5.01
-
cpe:2.3:o:zyxel:zywall_vpn100_firmware:5.37
-
cpe:2.3:o:zyxel:zywall_vpn300_firmware:10.02(abfc.0)c0
-
cpe:2.3:o:zyxel:zywall_vpn300_firmware:4.20
-
cpe:2.3:o:zyxel:zywall_vpn300_firmware:4.30
-
cpe:2.3:o:zyxel:zywall_vpn300_firmware:4.35
-
cpe:2.3:o:zyxel:zywall_vpn300_firmware:5.00
-
cpe:2.3:o:zyxel:zywall_vpn300_firmware:5.01
-
cpe:2.3:o:zyxel:zywall_vpn300_firmware:5.37