Missing Access Control in the \Free Time\ component of several Zyxel UAG USG and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.