critical9.1
CVE-2019-12583
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by direct…
Impact
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zyxel | Uag2100 Firmware | through 4.18\(aaiz.1\)c0 |
| Zyxel | Uag4100 Firmware | through 4.18\(aatd.1\)c0 |
| Zyxel | Uag5100 Firmware | through 4.18\(aapn.1\)c0 |
| Zyxel | Usg110 Firmware | through 4.33\(aaph.0\)c0 |
| Zyxel | Usg210 Firmware | through 4.33\(aapi.0\)c0 |
| Zyxel | Usg310 Firmware | through 4.33\(aapj.0\)c0 |
| Zyxel | Usg1100 Firmware | through 4.33\(aapk.0\)c0 |
| Zyxel | Usg1900 Firmware | through 4.33\(aapl.0\)c0 |
| Zyxel | Usg2200-Vpn Firmware | through 4.33\(abae.0\)c0 |
| Zyxel | Zywall Vpn100 Firmware | through 10.02\(abfv.0\)c0 |
| Zyxel | Zywall Vpn300 Firmware | through 10.02\(abfc.0\)c0 |
| Zyxel | Zywall 110 Firmware | through 4.33\(aaaa.0\)c0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
- https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml
- https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
- https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml