CVE-2019-12583
CRITICAL NUCLEIZyxel Uag2100 Firmware < 4.18\(aaiz.1\)c0 - Denial of Service
Title source: ruleDescription
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
Nuclei Templates (1)
Zyxel ZyWall UAG/USG - Account Creation Access
CRITICALby n-thumann,daffainfo
Shodan:
http.title:"zywall"
FOFA:
title="zywall"
Scores
CVSS v3
9.1
EPSS
0.5906
EPSS Percentile
98.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Details
CWE
CWE-425
Status
published
Products (14)
zyxel/uag2100_firmware
< 4.18\(aaiz.1\)c0
zyxel/uag4100_firmware
< 4.18\(aatd.1\)c0
zyxel/uag5100_firmware
< 4.18\(aapn.1\)c0
zyxel/usg1100_firmware
< 4.33\(aapk.0\)c0
zyxel/usg110_firmware
< 4.33\(aaph.0\)c0
zyxel/usg1900_firmware
< 4.33\(aapl.0\)c0
zyxel/usg210_firmware
< 4.33\(aapi.0\)c0
zyxel/usg2200-vpn_firmware
< 4.33\(abae.0\)c0
zyxel/usg310_firmware
< 4.33\(aapj.0\)c0
zyxel/zywall_1100_firmware
< 4.33\(aaac.0\)c0
... and 4 more
Published
Jun 27, 2019
Tracked Since
Feb 18, 2026