CVE-2019-12583
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices...
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
- Record
CVE-2019-12583- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-425
- Updated
- 2026-11-02
CVE List No score
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
- Record
CVE-2019-12583- Updated
- 2026-11-02
EUVDEUVD-2019-4177 No score
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
- Record
EUVD-2019-4177- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cq6f-phq5-pc66
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices...
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
- Record
GHSA-cq6f-phq5-pc66- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-425
- Updated
- 2026-11-02
Affected products
- zyxel uag2100 firmware
- zyxel uag4100 firmware
- zyxel uag5100 firmware
- zyxel usg1100 firmware
- zyxel usg110 firmware
- zyxel usg1900 firmware
- zyxel usg210 firmware
- zyxel usg2200-vpn firmware
- zyxel usg310 firmware
- zyxel zywall 1100 firmware
- zyxel zywall 110 firmware
- zyxel zywall 310 firmware
Show 2 moreShow less
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Zyxel ZyWall UAG/USG - Account Creation Access |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12583 is a critical vulnerability (CVSS 9.1) in Zyxel Uag2100 Firmware, published June 27, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 43.9%, the 98th percentile. No source names a fixed version.