CVE-2020-29583: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Other sources
Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-29583?
CVE-2020-29583 is a vulnerability found in Zyxel multiple products that allows unauthorized access with admin privileges.
How severe is CVE-2020-29583?
CVE-2020-29583 has a severity rating of 9.8 out of 10, making it a critical vulnerability.
Which Zyxel devices are affected by CVE-2020-29583?
Zyxel devices with firmware version 4.60, including USG20, USG20W, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200, Zywall110, Zywall310, and Zywall1100, are affected by CVE-2020-29583.
How can I fix CVE-2020-29583?
To fix CVE-2020-29583, you need to upgrade the firmware of the affected Zyxel device to version 4.60 Patch 1 or later.
Where can I find more information about CVE-2020-29583?
You can find more information about CVE-2020-29583 on the Zyxel support forum and the official Zyxel website.