ZeroDay Findings
Sign inSign up

Findings

CVE-2020-29583

Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

Published Dec 22, 2020 · updated Jun 16, 2026 · zyxel usg20-vpn firmware

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 22, 2020 · Catalog

    Detected

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe zyxel/usg110 firmware4.60
  • cpe zyxel/usg1100 firmware4.60
  • cpe zyxel/usg1900 firmware4.60
  • cpe zyxel/usg20-vpn firmware4.60
  • cpe zyxel/usg20w-vpn firmware4.60
  • cpe zyxel/usg210 firmware4.60
  • cpe zyxel/usg2200 firmware4.60
  • cpe zyxel/usg310 firmware4.60
  • cpe zyxel/usg40 firmware4.60
  • cpe zyxel/usg40w firmware4.60
  • cpe zyxel/usg60 firmware4.60
  • cpe zyxel/usg60w firmware4.60
  • vendor Zyxel Multiple Productsversion unspecified

Sources

  • CISA KEVCVE-2020-29583

    Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

    cisa.gov
  • CVE.orgCVE-2020-29583

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-29583

    30-day exploitation probability 90.2%

    first.org
  • NIST NVDCVE-2020-29583

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin p

    nvd.nist.gov

References