Zyxel ZyWall UAG/USG - Account Creation Access

ID: CVE-2019-12583

Severity: critical

Author: n-thumann,daffainfo

Tags: cve,cve2019,zyxel,zywall,xss

Description

Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator via the “Free Time” component. This can lead to unauthorized network access or DoS attacks.

YAML Source

id: CVE-2019-12583

info:
  name: Zyxel ZyWall UAG/USG - Account Creation Access
  author: n-thumann,daffainfo
  severity: critical
  description: Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator via the "Free Time" component. This can lead to unauthorized network access or DoS attacks.
  impact: |
    An attacker can exploit this vulnerability to create unauthorized accounts with administrative privileges.
  remediation: |
    Apply the latest firmware update provided by Zyxel to fix the vulnerability.
  reference:
    - https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml
    - https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-12583
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/StarCrossPortal/scalpel
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2019-12583
    cwe-id: CWE-425
    epss-score: 0.00481
    epss-percentile: 0.75875
    cpe: cpe:2.3:o:zyxel:uag2100_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zyxel
    product: uag2100_firmware
    shodan-query: http.title:"zywall"
    fofa-query: title="zywall"
    google-query: intitle:"zywall"
  tags: cve,cve2019,zyxel,zywall,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/free_time.cgi"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "free_time_redirect.cgi?u="
          - "&smsOnly=0"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100bf5dcf1765dfb3d89c6cd1dc0b6b4c96cc012140199d40ecf5c1a41965f7a090022100ee812839adeda82e37529ccf00ea67c9571ab73cefed2a595c455ded979259fb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-12583.yaml"

View on Github