Search criteria
4 vulnerabilities found for usg2200-vpn by zyxel
VAR-201906-0481
Vulnerability from variot - Updated: 2024-11-23 23:08Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service. Zyxel UAG , USG , ZyWall Devices have vulnerabilities related to authorization, permissions, and access control.Tampering with information and disrupting service operations (DoS) There is a possibility of being put into a state. ZyXEL ZyWall 310, etc. are all products of China Taiwan ZyXEL (ZyXEL). ZyXEL ZyWall 310 is a 310 series VPN firewall appliance. ZyXEL ZyWall 110 is a 110 series VPN firewall appliance. ZyXEL USG1900 is a next-generation unified security gateway device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201906-0481",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "usg1900",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.33\\(aapl.0\\)c0"
},
{
"model": "zywall 1100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.33\\(aaac.0\\)c0"
},
{
"model": "zywall 110",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.33\\(aaaa.0\\)c0"
},
{
"model": "uag2100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.18\\(aaiz.1\\)c0"
},
{
"model": "zywall 310",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.33\\(aaab.0\\)c0"
},
{
"model": "usg310",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.33\\(aapj.0\\)c0"
},
{
"model": "uag4100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.18\\(aatd.1\\)c0"
},
{
"model": "uag5100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.18\\(aapn.1\\)c0"
},
{
"model": "zywall vpn100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "10.02\\(abfv.0\\)c0"
},
{
"model": "zywall vpn300",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "10.02\\(abfc.0\\)c0"
},
{
"model": "usg110",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.33\\(aaph.0\\)c0"
},
{
"model": "usg1100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.33\\(aapk.0\\)c0"
},
{
"model": "usg2200-vpn",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.33\\(abae.0\\)c0"
},
{
"model": "usg210",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.33\\(aapi.0\\)c0"
},
{
"model": "uag2100",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "uag4100",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "uag5100",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg110",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg1100",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg1900",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg210",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg2200-vpn",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg310",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "zywall vpn100",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005788"
},
{
"db": "NVD",
"id": "CVE-2019-12583"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:zyxel:uag2100_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:uag4100_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:uag5100_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg1100_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg1900_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg210_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg2200-vpn_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg310_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:zywall_vpn100_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005788"
}
]
},
"cve": "CVE-2019-12583",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2019-12583",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-144344",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2019-12583",
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-12583",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2019-12583",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-201906-1052",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-144344",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2019-12583",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-144344"
},
{
"db": "VULMON",
"id": "CVE-2019-12583"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005788"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1052"
},
{
"db": "NVD",
"id": "CVE-2019-12583"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Missing Access Control in the \"Free Time\" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service. Zyxel UAG , USG , ZyWall Devices have vulnerabilities related to authorization, permissions, and access control.Tampering with information and disrupting service operations (DoS) There is a possibility of being put into a state. ZyXEL ZyWall 310, etc. are all products of China Taiwan ZyXEL (ZyXEL). ZyXEL ZyWall 310 is a 310 series VPN firewall appliance. ZyXEL ZyWall 110 is a 110 series VPN firewall appliance. ZyXEL USG1900 is a next-generation unified security gateway device",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-12583"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005788"
},
{
"db": "VULHUB",
"id": "VHN-144344"
},
{
"db": "VULMON",
"id": "CVE-2019-12583"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-12583",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005788",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1052",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-144344",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2019-12583",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-144344"
},
{
"db": "VULMON",
"id": "CVE-2019-12583"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005788"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1052"
},
{
"db": "NVD",
"id": "CVE-2019-12583"
}
]
},
"id": "VAR-201906-0481",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-144344"
}
],
"trust": 0.50806879
},
"last_update_date": "2024-11-23T23:08:23.866000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Zyxel security advisory for vulnerabilities related to the Free Time feature",
"trust": 0.8,
"url": "https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml"
},
{
"title": "Multiple ZyXEL Product Privilege License and Access Control Issue Vulnerability Fixes",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=112888"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005788"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1052"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-425",
"trust": 1.1
},
{
"problemtype": "CWE-264",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-144344"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005788"
},
{
"db": "NVD",
"id": "CVE-2019-12583"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://www.zyxel.com/support/vulnerabilities-related-to-the-free-time-feature.shtml"
},
{
"trust": 1.8,
"url": "https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-12583"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-12583"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/425.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-144344"
},
{
"db": "VULMON",
"id": "CVE-2019-12583"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005788"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1052"
},
{
"db": "NVD",
"id": "CVE-2019-12583"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-144344"
},
{
"db": "VULMON",
"id": "CVE-2019-12583"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005788"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1052"
},
{
"db": "NVD",
"id": "CVE-2019-12583"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-06-27T00:00:00",
"db": "VULHUB",
"id": "VHN-144344"
},
{
"date": "2019-06-27T00:00:00",
"db": "VULMON",
"id": "CVE-2019-12583"
},
{
"date": "2019-07-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-005788"
},
{
"date": "2019-06-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201906-1052"
},
{
"date": "2019-06-27T14:15:10.393000",
"db": "NVD",
"id": "CVE-2019-12583"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-144344"
},
{
"date": "2020-08-24T00:00:00",
"db": "VULMON",
"id": "CVE-2019-12583"
},
{
"date": "2019-07-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-005788"
},
{
"date": "2020-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201906-1052"
},
{
"date": "2024-11-21T04:23:08.263000",
"db": "NVD",
"id": "CVE-2019-12583"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201906-1052"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Zyxel Vulnerabilities related to authorization, authority, and access control in product devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005788"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201906-1052"
}
],
"trust": 0.6
}
}
VAR-201904-0115
Vulnerability from variot - Updated: 2024-11-23 23:04On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter. plural ZyXEL The product contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. ZyXELZyWall310 and other products are all products of ZyXEL Corporation of Taiwan, China. ZyXELZyWall310 is a 310 series VPN firewall device. ZyXELZyWall110 is a 110 series VPN firewall device. The ZyXELUSG1900 is a next-generation unified security gateway device. A cross-site scripting vulnerability exists in several Zyxel products that stems from the lack of proper validation of client data by web applications. An attacker could exploit the vulnerability to execute client code. ZyXEL ZyWall 310, etc. The following products are affected: Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, Zy0WALL
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "usg110",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "usg60w",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "usg60",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "usg40w",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "usg40",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "usg20w-vpn",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "usg20-vpn",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "atp800",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "atp500",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "atp200",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "usg20w-vpn",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "zywall 310",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg110",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg1100",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "zywall 1100",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg2200-vpn",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "atp500",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg40w",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "atp200",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg40",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "vpn300",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "zywall 110",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg1900",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg20-vpn",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg60",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "vpn50",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "vpn100",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "atp800",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg60w",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg310",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "usg210",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.31"
},
{
"_id": null,
"model": "nbg-418n modem",
"scope": "eq",
"trust": 0.6,
"vendor": "zyxel",
"version": "v2"
},
{
"_id": null,
"model": "nas",
"scope": "eq",
"trust": 0.6,
"vendor": "zyxel",
"version": "326"
},
{
"_id": null,
"model": "usg1100",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "usg310",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "usg210",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "zywall",
"scope": "eq",
"trust": 0.6,
"vendor": "zyxel",
"version": "1100"
},
{
"_id": null,
"model": "zywall",
"scope": "eq",
"trust": 0.6,
"vendor": "zyxel",
"version": "310"
},
{
"_id": null,
"model": "zywall",
"scope": "eq",
"trust": 0.6,
"vendor": "zyxel",
"version": "110"
},
{
"_id": null,
"model": "usg2200-vpn",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"_id": null,
"model": "usg1900",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-13778"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004359"
},
{
"db": "NVD",
"id": "CVE-2019-9955"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:zyxel:atp200_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:atp500_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:atp800_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg20-vpn_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg20w-vpn_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg40_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg40w_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg60_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg60w_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-004359"
}
]
},
"credits": {
"_id": null,
"data": "Aaron Bishop",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201904-785"
}
],
"trust": 0.6
},
"cve": "CVE-2019-9955",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2019-9955",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2019-13778",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-161390",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2019-9955",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-9955",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2019-9955",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2019-13778",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201904-785",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-161390",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2019-9955",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-13778"
},
{
"db": "VULHUB",
"id": "VHN-161390"
},
{
"db": "VULMON",
"id": "CVE-2019-9955"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004359"
},
{
"db": "CNNVD",
"id": "CNNVD-201904-785"
},
{
"db": "NVD",
"id": "CVE-2019-9955"
}
]
},
"description": {
"_id": null,
"data": "On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized \u0027mp_idx\u0027 parameter. plural ZyXEL The product contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. ZyXELZyWall310 and other products are all products of ZyXEL Corporation of Taiwan, China. ZyXELZyWall310 is a 310 series VPN firewall device. ZyXELZyWall110 is a 110 series VPN firewall device. The ZyXELUSG1900 is a next-generation unified security gateway device. A cross-site scripting vulnerability exists in several Zyxel products that stems from the lack of proper validation of client data by web applications. An attacker could exploit the vulnerability to execute client code. ZyXEL ZyWall 310, etc. The following products are affected: Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, Zy0WALL ",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9955"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004359"
},
{
"db": "CNVD",
"id": "CNVD-2019-13778"
},
{
"db": "VULHUB",
"id": "VHN-161390"
},
{
"db": "VULMON",
"id": "CVE-2019-9955"
}
],
"trust": 2.34
},
"exploit_availability": {
"_id": null,
"data": [
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=46706",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2019-9955"
}
]
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2019-9955",
"trust": 3.2
},
{
"db": "PACKETSTORM",
"id": "152525",
"trust": 1.8
},
{
"db": "EXPLOIT-DB",
"id": "46706",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004359",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201904-785",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-13778",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-161390",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2019-9955",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-13778"
},
{
"db": "VULHUB",
"id": "VHN-161390"
},
{
"db": "VULMON",
"id": "CVE-2019-9955"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004359"
},
{
"db": "CNNVD",
"id": "CNNVD-201904-785"
},
{
"db": "NVD",
"id": "CVE-2019-9955"
}
]
},
"id": "VAR-201904-0115",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-13778"
},
{
"db": "VULHUB",
"id": "VHN-161390"
}
],
"trust": 1.2644510616666667
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-13778"
}
]
},
"last_update_date": "2024-11-23T23:04:48.660000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Zyxel security advisory for reflected cross-site scripting vulnerability of firewalls",
"trust": 0.8,
"url": "https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml"
},
{
"title": "CVEs",
"trust": 0.1,
"url": "https://github.com/irbishop/CVEs "
},
{
"title": "CVEs",
"trust": 0.1,
"url": "https://github.com/irbishop/CVE "
},
{
"title": "nuclei-templates",
"trust": 0.1,
"url": "https://github.com/storenth/nuclei-templates "
},
{
"title": "kenzer-templates",
"trust": 0.1,
"url": "https://github.com/Elsfa7-110/kenzer-templates "
},
{
"title": "kenzer-templates",
"trust": 0.1,
"url": "https://github.com/ARPSyndicate/kenzer-templates "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2019-9955"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004359"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-161390"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004359"
},
{
"db": "NVD",
"id": "CVE-2019-9955"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.6,
"url": "https://www.securitymetrics.com/blog/zyxel-devices-vulnerable-cross-site-scripting-login-page"
},
{
"trust": 2.4,
"url": "http://seclists.org/fulldisclosure/2019/apr/22"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/152525/zyxel-zywall-cross-site-scripting.html"
},
{
"trust": 1.8,
"url": "https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml"
},
{
"trust": 1.8,
"url": "https://www.exploit-db.com/exploits/46706/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9955"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-9955"
},
{
"trust": 0.7,
"url": "https://www.exploit-db.com/exploits/46706"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/79.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/irbishop/cves"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-13778"
},
{
"db": "VULHUB",
"id": "VHN-161390"
},
{
"db": "VULMON",
"id": "CVE-2019-9955"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004359"
},
{
"db": "CNNVD",
"id": "CNNVD-201904-785"
},
{
"db": "NVD",
"id": "CVE-2019-9955"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-13778",
"ident": null
},
{
"db": "VULHUB",
"id": "VHN-161390",
"ident": null
},
{
"db": "VULMON",
"id": "CVE-2019-9955",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004359",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201904-785",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2019-9955",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2019-05-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-13778",
"ident": null
},
{
"date": "2019-04-22T00:00:00",
"db": "VULHUB",
"id": "VHN-161390",
"ident": null
},
{
"date": "2019-04-22T00:00:00",
"db": "VULMON",
"id": "CVE-2019-9955",
"ident": null
},
{
"date": "2019-05-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-004359",
"ident": null
},
{
"date": "2019-04-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201904-785",
"ident": null
},
{
"date": "2019-04-22T20:29:00.447000",
"db": "NVD",
"id": "CVE-2019-9955",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2019-05-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-13778",
"ident": null
},
{
"date": "2019-04-30T00:00:00",
"db": "VULHUB",
"id": "VHN-161390",
"ident": null
},
{
"date": "2019-04-30T00:00:00",
"db": "VULMON",
"id": "CVE-2019-9955",
"ident": null
},
{
"date": "2019-05-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-004359",
"ident": null
},
{
"date": "2019-04-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201904-785",
"ident": null
},
{
"date": "2024-11-21T04:52:39.943000",
"db": "NVD",
"id": "CVE-2019-9955",
"ident": null
}
]
},
"title": {
"_id": null,
"data": "plural ZyXEL Product cross-site scripting vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-004359"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201904-785"
}
],
"trust": 0.6
}
}
VAR-201906-0479
Vulnerability from variot - Updated: 2024-11-23 22:11A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter. Zyxel ZyWall , USG , UAG The device contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. ZyXEL ZyWall 310, etc. are all products of China Taiwan ZyXEL (ZyXEL). ZyXEL ZyWall 310 is a 310 series VPN firewall appliance. ZyXEL ZyWall 110 is a 110 series VPN firewall appliance. ZyXEL USG1900 is a next-generation unified security gateway device. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201906-0479",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "usg210",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.30"
},
{
"model": "usg310",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.30"
},
{
"model": "usg1100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.30"
},
{
"model": "uag4100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.18\\(aatd.1\\)c0"
},
{
"model": "uag5100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.18\\(aapn.1\\)c0"
},
{
"model": "usg1900",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.30"
},
{
"model": "usg110",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.30"
},
{
"model": "usg2200-vpn",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.30"
},
{
"model": "uag2100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.18\\(aaiz.1\\)c0"
},
{
"model": "uag2100",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "uag4100",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "uag5100",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg110",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg1100",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg1900",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg210",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg2200-vpn",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg310",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005789"
},
{
"db": "NVD",
"id": "CVE-2019-12581"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:zyxel:uag2100_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:uag4100_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:uag5100_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg110_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg1100_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg1900_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg210_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg2200-vpn_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:usg310_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005789"
}
]
},
"cve": "CVE-2019-12581",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2019-12581",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-144342",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2019-12581",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-12581",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2019-12581",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201906-1053",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-144342",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2019-12581",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-144342"
},
{
"db": "VULMON",
"id": "CVE-2019-12581"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005789"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1053"
},
{
"db": "NVD",
"id": "CVE-2019-12581"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter. Zyxel ZyWall , USG , UAG The device contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. ZyXEL ZyWall 310, etc. are all products of China Taiwan ZyXEL (ZyXEL). ZyXEL ZyWall 310 is a 310 series VPN firewall appliance. ZyXEL ZyWall 110 is a 110 series VPN firewall appliance. ZyXEL USG1900 is a next-generation unified security gateway device. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-12581"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005789"
},
{
"db": "VULHUB",
"id": "VHN-144342"
},
{
"db": "VULMON",
"id": "CVE-2019-12581"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-12581",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005789",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1053",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-144342",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2019-12581",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-144342"
},
{
"db": "VULMON",
"id": "CVE-2019-12581"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005789"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1053"
},
{
"db": "NVD",
"id": "CVE-2019-12581"
}
]
},
"id": "VAR-201906-0479",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-144342"
}
],
"trust": 0.50806879
},
"last_update_date": "2024-11-23T22:11:59.750000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.zyxel.com/us/en/"
},
{
"title": "Zyxel security advisory for vulnerabilities related to the Free Time feature",
"trust": 0.8,
"url": "https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml"
},
{
"title": "Multiple ZyXEL Fixes for product cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=112889"
},
{
"title": "Kenzer Templates [5170] [DEPRECATED]",
"trust": 0.1,
"url": "https://github.com/ARPSyndicate/kenzer-templates "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2019-12581"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005789"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1053"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-144342"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005789"
},
{
"db": "NVD",
"id": "CVE-2019-12581"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://sec-consult.com/en/blog/advisories/reflected-cross-site-scripting-in-zxel-zywall/index.html"
},
{
"trust": 1.8,
"url": "https://www.zyxel.com/support/vulnerabilities-related-to-the-free-time-feature.shtml"
},
{
"trust": 1.8,
"url": "https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/"
},
{
"trust": 1.8,
"url": "https://www.zyxel.com/us/en/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-12581"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-12581"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/79.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/arpsyndicate/kenzer-templates"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-144342"
},
{
"db": "VULMON",
"id": "CVE-2019-12581"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005789"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1053"
},
{
"db": "NVD",
"id": "CVE-2019-12581"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-144342"
},
{
"db": "VULMON",
"id": "CVE-2019-12581"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005789"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-1053"
},
{
"db": "NVD",
"id": "CVE-2019-12581"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-06-27T00:00:00",
"db": "VULHUB",
"id": "VHN-144342"
},
{
"date": "2019-06-27T00:00:00",
"db": "VULMON",
"id": "CVE-2019-12581"
},
{
"date": "2019-07-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-005789"
},
{
"date": "2019-06-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201906-1053"
},
{
"date": "2019-06-27T15:15:09.170000",
"db": "NVD",
"id": "CVE-2019-12581"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-06-28T00:00:00",
"db": "VULHUB",
"id": "VHN-144342"
},
{
"date": "2019-06-28T00:00:00",
"db": "VULMON",
"id": "CVE-2019-12581"
},
{
"date": "2019-07-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-005789"
},
{
"date": "2020-03-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201906-1053"
},
{
"date": "2024-11-21T04:23:08.050000",
"db": "NVD",
"id": "CVE-2019-12581"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201906-1053"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Zyxel Product site cross-site scripting vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005789"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201906-1053"
}
],
"trust": 0.6
}
}
VAR-202107-0888
Vulnerability from variot - Updated: 2024-08-14 15:38An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device. plural Zyxel There is an authentication vulnerability in the firmware.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202107-0888",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "usg310",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg310",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg flex 100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg flex 200",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg flex 700",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "zywall atp100w",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "zywall atp100w",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg flex 100",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg flex 700",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg60w",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "zywall atp100",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall vpn300",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg20w-vpn",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg2200-vpn",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "zywall 110",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg100",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg60w",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall atp100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg2200-vpn",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg300",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg flex 200",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg110",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg40",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg40w",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "zywall vpn50",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "zywall atp200",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall 1100",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg300",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg1000",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall vpn300",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall 110",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg110",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg1100",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg1000",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg40w",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg40",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall atp200",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg1100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "zywall atp700",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "zywall atp800",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall atp800",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "zywall vpn50",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall 1100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg200",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg200",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "zywall atp700",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg60",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg1900",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg60",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg20w",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "zywall atp500",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg20-vpn",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg flex 500",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall atp500",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg20-vpn",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg1900",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg210",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg20w",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg20",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg50",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg flex 500",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg210",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg50",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "zywall vpn100",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg flex 100w",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall vpn100",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "zywall 310",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg flex 100w",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "zywall 310",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg2000",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg20",
"scope": "gte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.35"
},
{
"model": "usg20w-vpn",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "5.01"
},
{
"model": "usg2000",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "4.64"
},
{
"model": "usg210",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg1900",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg40",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg60",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg40w",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg110",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg300",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg310",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg60w",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "usg1100",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-008898"
},
{
"db": "NVD",
"id": "CVE-2021-35029"
}
]
},
"cve": "CVE-2021-35029",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2021-35029",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2021-35029",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2021-008898",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2021-35029",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "security@zyxel.com.tw",
"id": "CVE-2021-35029",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2021-35029",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-202107-147",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2021-35029",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2021-35029"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008898"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-147"
},
{
"db": "NVD",
"id": "CVE-2021-35029"
},
{
"db": "NVD",
"id": "CVE-2021-35029"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device. plural Zyxel There is an authentication vulnerability in the firmware.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-35029"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008898"
},
{
"db": "VULMON",
"id": "CVE-2021-35029"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-35029",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008898",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202107-147",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-35029",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2021-35029"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008898"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-147"
},
{
"db": "NVD",
"id": "CVE-2021-35029"
}
]
},
"id": "VAR-202107-0888",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.38938492750000003
},
"last_update_date": "2024-08-14T15:38:00.341000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Zyxel\u00a0security\u00a0advisory\u00a0for\u00a0attacks\u00a0against\u00a0security\u00a0appliances",
"trust": 0.8,
"url": "https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml"
},
{
"title": "ZyXEL ZyWALL USG Remediation measures for authorization problem vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=155962"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-008898"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-147"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.0
},
{
"problemtype": "Improper authentication (CWE-287) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-008898"
},
{
"db": "NVD",
"id": "CVE-2021-35029"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://www.zyxel.com/support/zyxel_security_advisory_for_attacks_against_security_appliances.shtml"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-35029"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/287.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2021-35029"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008898"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-147"
},
{
"db": "NVD",
"id": "CVE-2021-35029"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2021-35029"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008898"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-147"
},
{
"db": "NVD",
"id": "CVE-2021-35029"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-07-02T00:00:00",
"db": "VULMON",
"id": "CVE-2021-35029"
},
{
"date": "2022-03-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-008898"
},
{
"date": "2021-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202107-147"
},
{
"date": "2021-07-02T11:15:08.930000",
"db": "NVD",
"id": "CVE-2021-35029"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-07-08T00:00:00",
"db": "VULMON",
"id": "CVE-2021-35029"
},
{
"date": "2022-03-31T04:46:00",
"db": "JVNDB",
"id": "JVNDB-2021-008898"
},
{
"date": "2021-07-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202107-147"
},
{
"date": "2021-07-08T18:20:48.127000",
"db": "NVD",
"id": "CVE-2021-35029"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202107-147"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0Zyxel\u00a0 Firmware authentication vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-008898"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202107-147"
}
],
"trust": 0.6
}
}