CVE-2019-12583
First published: Thu Jun 27 2019(Updated: )
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zyxel Uag2100 Firmware | <=4.18\(aaiz.1\)c0 | |
| Zyxel Uag2100 | ||
| Zyxel Uag4100 Firmware | <=4.18\(aatd.1\)c0 | |
| Zyxel Uag4100 | ||
| Zyxel Uag5100 Firmware | <=4.18\(aapn.1\)c0 | |
| Zyxel Uag5100 | ||
| Zyxel Usg110 Firmware | <=4.33\(aaph.0\)c0 | |
| Zyxel Usg110 | ||
| Zyxel Usg210 Firmware | <=4.33\(aapi.0\)c0 | |
| Zyxel Usg210 | ||
| Zyxel Usg310 Firmware | <=4.33\(aapj.0\)c0 | |
| Zyxel Usg310 | ||
| Zyxel Usg1100 Firmware | <=4.33\(aapk.0\)c0 | |
| Zyxel Usg1100 | ||
| Zyxel Usg1900 Firmware | <=4.33\(aapl.0\)c0 | |
| Zyxel Usg1900 | ||
| Zyxel Usg2200-vpn Firmware | <=4.33\(abae.0\)c0 | |
| Zyxel Usg2200-vpn | ||
| Zyxel Zywall Vpn100 Firmware | <=10.02\(abfv.0\)c0 | |
| Zyxel Zywall Vpn100 | ||
| Zyxel Zywall Vpn300 Firmware | <=10.02\(abfc.0\)c0 | |
| Zyxel Zywall Vpn300 | ||
| Zyxel Zywall 110 Firmware | <=4.33\(aaaa.0\)c0 | |
| Zyxel Zywall 110 | ||
| Zyxel Zywall 310 Firmware | <=4.33\(aaab.0\)c0 | |
| Zyxel Zywall 310 | ||
| Zyxel Zywall 1100 Firmware | <=4.33\(aaac.0\)c0 | |
| Zyxel Zywall 1100 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-12583.
What is the severity of CVE-2019-12583?
The severity of CVE-2019-12583 is critical with a CVSS score of 9.1.
Which devices are affected by CVE-2019-12583?
Several Zyxel UAG, USG, and ZyWall devices are affected by CVE-2019-12583. Specifically, Zyxel UAG2100 Firmware up to version 4.18(aaiz.1)c0, Zyxel UAG4100 Firmware up to version 4.18(aatd.1)c0, Zyxel UAG5100 Firmware up to version 4.18(aapn.1)c0, Zyxel USG110 Firmware up to version 4.33(aaph.0)c0, Zyxel USG210 Firmware up to version 4.33(aapi.0)c0, Zyxel USG310 Firmware up to version 4.33(aapj.0)c0, Zyxel USG1100 Firmware up to version 4.33(aapk.0)c0, Zyxel USG1900 Firmware up to version 4.33(aapl.0)c0, Zyxel USG2200-vpn Firmware up to version 4.33(abae.0)c0, Zyxel Zywall Vpn100 Firmware up to version 10.02(abfv.0)c0, Zyxel Zywall Vpn300 Firmware up to version 10.02(abfc.0)c0, Zyxel Zywall 110 Firmware up to version 4.33(aaaa.0)c0, Zyxel Zywall 310 Firmware up to version 4.33(aaab.0)c0, and Zyxel Zywall 1100 Firmware up to version 4.33(aaac.0)c0.
What is the impact of CVE-2019-12583?
The impact of CVE-2019-12583 is that a remote attacker can generate guest accounts by directly accessing the account generator, leading to unauthorized network access or denial of service.
How can I fix CVE-2019-12583?
To fix CVE-2019-12583, it is recommended to update the firmware of the affected Zyxel UAG, USG, and ZyWall devices to a version that includes a fix for this vulnerability. Contact Zyxel for further assistance.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/event
- agent/type
- agent/description
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/zyxel
- canonical/zyxel uag2100 firmware
- version/zyxel uag2100 firmware/4.18\(aaiz.1\)c0
- canonical/zyxel uag2100
- canonical/zyxel uag4100 firmware
- version/zyxel uag4100 firmware/4.18\(aatd.1\)c0
- canonical/zyxel uag4100
- canonical/zyxel uag5100 firmware
- version/zyxel uag5100 firmware/4.18\(aapn.1\)c0
- canonical/zyxel uag5100
- canonical/zyxel usg110 firmware
- version/zyxel usg110 firmware/4.33\(aaph.0\)c0
- canonical/zyxel usg110
- canonical/zyxel usg210 firmware
- version/zyxel usg210 firmware/4.33\(aapi.0\)c0
- canonical/zyxel usg210
- canonical/zyxel usg310 firmware
- version/zyxel usg310 firmware/4.33\(aapj.0\)c0
- canonical/zyxel usg310
- canonical/zyxel usg1100 firmware
- version/zyxel usg1100 firmware/4.33\(aapk.0\)c0
- canonical/zyxel usg1100
- canonical/zyxel usg1900 firmware
- version/zyxel usg1900 firmware/4.33\(aapl.0\)c0
- canonical/zyxel usg1900
- canonical/zyxel usg2200-vpn firmware
- version/zyxel usg2200-vpn firmware/4.33\(abae.0\)c0
- canonical/zyxel usg2200-vpn
- canonical/zyxel zywall vpn100 firmware
- version/zyxel zywall vpn100 firmware/10.02\(abfv.0\)c0
- canonical/zyxel zywall vpn100
- canonical/zyxel zywall vpn300 firmware
- version/zyxel zywall vpn300 firmware/10.02\(abfc.0\)c0
- canonical/zyxel zywall vpn300
- canonical/zyxel zywall 110 firmware
- version/zyxel zywall 110 firmware/4.33\(aaaa.0\)c0
- canonical/zyxel zywall 110
- canonical/zyxel zywall 310 firmware
- version/zyxel zywall 310 firmware/4.33\(aaab.0\)c0
- canonical/zyxel zywall 310
- canonical/zyxel zywall 1100 firmware
- version/zyxel zywall 1100 firmware/4.33\(aaac.0\)c0
- canonical/zyxel zywall 1100