CVSS 3.0
9.1 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HCVE-2019-12583
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
Severity
- EPSS
- 44% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-425
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zyxel:uag2100_firmware
- zyxel:uag4100_firmware
- zyxel:uag5100_firmware
- zyxel:usg1100_firmware
- zyxel:usg110_firmware
- zyxel:usg1900_firmware
- zyxel:usg210_firmware
- zyxel:usg2200-vpn_firmware
- zyxel:usg310_firmware
- zyxel:zywall_1100_firmware
- zyxel:zywall_110_firmware
- zyxel:zywall_310_firmware
- zyxel:zywall_vpn100_firmware
- zyxel:zywall_vpn300_firmware
References
- https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
- https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml
- https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
- https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml