CVE-2019-12581

MEDIUMNuclei

Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-12581 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMZyxel ZyWal/USG/UAG Devices - Cross-Site ScriptingCVSS 6.1

Zyxel ZyWall, USG, and UAG devices allow remote attackers to inject arbitrary web script or HTML via the err_msg parameter free_time_failed.cgi CGI program, aka reflective cross-site scripting.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest firmware update provided by Zyxel to fix the XSS vulnerability.

WeaknessesCWE-79
Authorsn-thumann
Template tagscvecve2019zyxelzywallxssvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:h:zyxel:uag2100:-:*:*:*:*:*:*:*
Shodan: http.title:"ZyWall"
FOFA: title="zywall"
Google: intitle:"zywall"
https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-zxel-zywall/ https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/ https://nvd.nist.gov/vuln/detail/CVE-2019-12581 https://www.zyxel.com/us/en/

Source: ProjectDiscovery

References

5