CVE-2019-12583

Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.

• zyxel uag2100 firmware (<= 4.18\(aaiz.1\)c0) • zyxel uag4100 firmware (<= 4.18\(aatd.1\)c0) • zyxel uag5100 firmware (<= 4.18\(aapn.1\)c0) • zyxel usg110 firmware (<= 4.33\(aaph.0\)c0) • zyxel usg210 firmware (<= 4.33\(aapi.0\)c0) • zyxel usg310 firmware (<= 4.33\(aapj.0\)c0) • zyxel usg1100 firmware (<= 4.33\(aapk.0\)c0) • zyxel usg1900 firmware (<= 4.33\(aapl.0\)c0) • zyxel usg2200-vpn firmware (<= 4.33\(abae.0\)c0) • zyxel zywall vpn100 firmware (<= 10.02\(abfv.0\)c0) • zyxel zywall vpn300 firmware (<= 10.02\(abfc.0\)c0) • zyxel zywall 110 firmware (<= 4.33\(aaaa.0\)c0) • zyxel zywall 310 firmware (<= 4.33\(aaab.0\)c0) • zyxel zywall 1100 firmware (<= 4.33\(aaac.0\)c0)