CVE-2020-29583

Zyxel Multiple Products Use of Hard-Coded Credentials

9.8 CRITICALActively exploited (CISA KEV)Public exploitEPSS 90.2%

Published22 Dec 2020
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Zyxel Atp100 Firmware4.60

Zyxel Atp100w Firmware4.60

Zyxel Atp200 Firmware4.60

Zyxel Atp500 Firmware4.60

Zyxel Atp700 Firmware4.60

Zyxel Atp800 Firmware4.60

Zyxel Usg1100 Firmware4.60

Zyxel Usg110 Firmware4.60

Zyxel Usg1900 Firmware4.60

Zyxel Usg20-vpn Firmware4.60

Zyxel Usg20w-vpn Firmware4.60

Zyxel Usg210 Firmware4.60

Zyxel Usg2200 Firmware4.60

Zyxel Usg310 Firmware4.60

Zyxel Usg40 Firmware4.60

Zyxel Usg40w Firmware4.60

Zyxel Usg60 Firmware4.60

Zyxel Usg60w Firmware4.60

Zyxel Usg Flex 100 Firmware4.60

Zyxel Usg Flex 100w Firmware4.60

Zyxel Usg Flex 200 Firmware4.60

Zyxel Usg Flex 500 Firmware4.60

Zyxel Usg Flex 700 Firmware4.60

Zyxel Vpn1000 Firmware4.60

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdfBroken Link
https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-releaseRelease Notes
https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583US Government Resource
https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.htmlBroken LinkThird Party Advisory
https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/ExploitThird Party Advisory
https://www.zyxel.com/support/CVE-2020-29583.shtmlVendor Advisory
https://www.zyxel.com/support/security_advisories.shtmlVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2020-29583 being actively exploited?

Yes. CVE-2020-29583 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2020-29583?

CVE-2020-29583 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 90.2% probability of exploitation.

Which products are affected by CVE-2020-29583?

Affected products include Zyxel Atp100 Firmware, Zyxel Atp100w Firmware, Zyxel Atp200 Firmware, Zyxel Atp500 Firmware, Zyxel Atp700 Firmware, and 19 more.

How do I fix CVE-2020-29583?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-29583 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.