CVE-2019-12581 : A reflective Cross-site scripting (XSS) vulnerability in the free_time

A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.

Published 2019-06-27 15:15:09

Updated 2019-06-28 17:28:12

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2019-12581

Zyxel » Usg110 Firmware
Versions up to, including, (<=) 4.30
cpe:2.3:o:zyxel:usg110_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg110 » Version: N/A
Zyxel » Usg210 Firmware
Versions up to, including, (<=) 4.30
cpe:2.3:o:zyxel:usg210_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg210 » Version: N/A
Zyxel » Usg310 Firmware
Versions up to, including, (<=) 4.30
cpe:2.3:o:zyxel:usg310_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg310 » Version: N/A
Zyxel » Usg1100 Firmware
Versions up to, including, (<=) 4.30
cpe:2.3:o:zyxel:usg1100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg1100 » Version: N/A
Zyxel » Usg1900 Firmware
Versions up to, including, (<=) 4.30
cpe:2.3:o:zyxel:usg1900_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg1900 » Version: N/A
Zyxel » Usg2200-vpn Firmware
Versions up to, including, (<=) 4.30
cpe:2.3:o:zyxel:usg2200-vpn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg2200-vpn » Version: N/A
Zyxel » Uag2100 Firmware
Versions up to, including, (<=) 4.18\(aaiz.1\)c0
cpe:2.3:o:zyxel:uag2100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Uag2100 » Version: N/A
Zyxel » Uag4100 Firmware
Versions up to, including, (<=) 4.18\(aatd.1\)c0
cpe:2.3:o:zyxel:uag4100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Uag4100 » Version: N/A
Zyxel » Uag5100 Firmware
Versions up to, including, (<=) 4.18\(aapn.1\)c0
cpe:2.3:o:zyxel:uag5100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Uag5100 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-12581

EPSS FAQ

62.86%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-12581

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2019-12581

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-12581

https://sec-consult.com/en/blog/advisories/reflected-cross-site-scripting-in-zxel-zywall/index.html

Reflected Cross-Site Scripting in Zyxel ZyWALL – SEC Consult
Exploit;Patch;Third Party Advisory
https://www.zyxel.com/us/en/

Zyxel, Your Networking Ally
Vendor Advisory

CVEs referencing this url
https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml

Zyxel security advisory for vulnerabilities related to the Free Time feature | Zyxel
Patch;Vendor Advisory

CVEs referencing this url
https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/

Zyxel Gateways: Missing Access Control in Account Generator & XSS
Exploit;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2019-12581

Products affected by CVE-2019-12581

Exploit prediction scoring system (EPSS) score for CVE-2019-12581

CVSS scores for CVE-2019-12581

CWE ids for CVE-2019-12581

References for CVE-2019-12581