Improper access control

2019-06-2714:15:00

PRIOn knowledge base

www.prio-n.com

9 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.1%

JSON

Missing Access Control in the “Free Time” component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.

CPENameOperatorVersion
uag2100_firmwareeq<= 4.18aaiz.1c0
uag4100_firmwareeq<= 4.18aatd.1c0
uag5100_firmwareeq<= 4.18aapn.1c0
usg1100_firmwareeq<= 4.33aapk.0c0
usg110_firmwareeq<= 4.33aaph.0c0
usg1900_firmwareeq<= 4.33aapl.0c0
usg210_firmwareeq<= 4.33aapi.0c0
usg2200-vpn_firmwareeq<= 4.33abae.0c0
usg310_firmwareeq<= 4.33aapj.0c0
zywall_1100_firmwareeq<= 4.33aaac.0c0

Name	Operator	Version
uag2100_firmware	eq	<= 4.18aaiz.1c0
uag4100_firmware	eq	<= 4.18aatd.1c0
uag5100_firmware	eq	<= 4.18aapn.1c0
usg1100_firmware	eq	<= 4.33aapk.0c0
usg110_firmware	eq	<= 4.33aaph.0c0
usg1900_firmware	eq	<= 4.33aapl.0c0
usg210_firmware	eq	<= 4.33aapi.0c0
usg2200-vpn_firmware	eq	<= 4.33abae.0c0
usg310_firmware	eq	<= 4.33aapj.0c0
zywall_1100_firmware	eq	<= 4.33aaac.0c0