CVSS 3.0
6.1 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2019-12581
Medium (6.1) in zyxel. EPSS 6.4% chance of exploitation in the next 30 days.
A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.
Severity
- EPSS
- 6.4% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zyxel:uag2100_firmware
- zyxel:uag4100_firmware
- zyxel:uag5100_firmware
- zyxel:usg1100_firmware
- zyxel:usg110_firmware
- zyxel:usg1900_firmware
- zyxel:usg210_firmware
- zyxel:usg2200-vpn_firmware
- zyxel:usg310_firmware
References
- https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
- https://sec-consult.com/en/blog/advisories/reflected-cross-site-scripting-in-zxel-zywall/index.html
- https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml
- https://www.zyxel.com/us/en/
- https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/