Login Request a demo
Critical severity · published Jun 27, 2019
CVE-2019-12583
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the…
9.1
CVSS
43.9%
EPSS
No
On KEV
Description
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)43.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UF
Uag2100 Firmware · Zyxel
through 4.18\(aaiz.1\)c0 · source: NVD
UF
Uag4100 Firmware · Zyxel
through 4.18\(aatd.1\)c0 · source: NVD
UF
Uag5100 Firmware · Zyxel
through 4.18\(aapn.1\)c0 · source: NVD
UF
Usg110 Firmware · Zyxel
through 4.33\(aaph.0\)c0 · source: NVD
UF
Usg1100 Firmware · Zyxel
through 4.33\(aapk.0\)c0 · source: NVD
UF
Usg1900 Firmware · Zyxel
through 4.33\(aapl.0\)c0 · source: NVD
UF
Usg210 Firmware · Zyxel
through 4.33\(aapi.0\)c0 · source: NVD
UF
Usg2200-vpn Firmware · Zyxel
through 4.33\(abae.0\)c0 · source: NVD
UF
Usg310 Firmware · Zyxel
through 4.33\(aapj.0\)c0 · source: NVD
Z1
Zywall 110 Firmware · Zyxel
through 4.33\(aaaa.0\)c0 · source: NVD
Z1
Zywall 1100 Firmware · Zyxel
through 4.33\(aaac.0\)c0 · source: NVD
Z3
Zywall 310 Firmware · Zyxel
through 4.33\(aaab.0\)c0 · source: NVD
Affected product
UF
Uag2100 Firmware
Zyxel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12583
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12583
Exploit
https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
Patch
https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml
More from Uag2100 Firmware
6.1
CVE-2019-12581
A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject…