Zyxel ZyWall UAG/USG - Account Creation Access

criticalseverity

9.1CVSS score

43.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator via the "Free Time" component. This can lead to unauthorized network access or DoS attacks.

Impact

An attacker can exploit this vulnerability to create unauthorized accounts with administrative privileges.

Fix

Apply the latest firmware update provided by Zyxel to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/free_time.cgi
Positive when: contains "free_time_redirect.cgi?u=" and "&smsOnly=0" AND status 200

Run it with nuclei: nuclei -id CVE-2019-12583 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-12583

info:
  name: Zyxel ZyWall UAG/USG - Account Creation Access
  author: n-thumann,daffainfo
  severity: critical
  description: Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator via the "Free Time" component. This can lead to unauthorized network access or DoS attacks.
  impact: |
    An attacker can exploit this vulnerability to create unauthorized accounts with administrative privileges.
  remediation: |
    Apply the latest firmware update provided by Zyxel to fix the vulnerability.
  reference:
    - https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml
    - https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-12583
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/StarCrossPortal/scalpel
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2019-12583
    cwe-id: CWE-425
    epss-score: 0.43926
    epss-percentile: 0.9876
    cpe: cpe:2.3:o:zyxel:uag2100_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zyxel
    product: uag2100_firmware
    shodan-query: http.title:"zywall"
    fofa-query: title="zywall"
    google-query: intitle:"zywall"
  tags: cve,cve2019,zyxel,zywall,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/free_time.cgi"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "free_time_redirect.cgi?u="
          - "&smsOnly=0"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from