Posted by RedTeam Pentesting GmbH on May 04
Advisory: Client Side Authorization ZyXEL ZyWALL USG Appliances Web
Interface
The ZyXEL ZyWALL USG appliances perform parts of the authorization for
their management web interface on the client side using JavaScript. By
setting the JavaScript variable "isAdmin" to "true", a user with limited
access gets full access to the web interface.
Details
=======
Product: ZyXEL USG (Unified Security Gateway) appliances…
Source: [RT-SA-2011-004] Client Side Authorization ZyXEL ZyWALL USG Appliances Web Interface
