# CVE-2020-29583

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

- Page: https://www.vulneraibility.com/cve/CVE-2020-29583
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2021-11-03; CISA due date 2022-05-03
- EPSS: 90.16% (percentile 99.8)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept · 1 Nuclei template (first 2021-01-04)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-02-10)
- Weakness: CWE-522
- Published: 2020-12-22

## Affected

- zyxel:usg20-vpn_firmware
- zyxel:usg20w-vpn_firmware
- zyxel:usg40_firmware
- zyxel:usg40w_firmware
- zyxel:usg60_firmware
- zyxel:usg60w_firmware
- zyxel:usg110_firmware
- zyxel:usg210_firmware
- zyxel:usg310_firmware
- zyxel:usg1100_firmware
- zyxel:usg1900_firmware
- zyxel:usg2200_firmware
- zyxel:zywall110_firmware
- zyxel:zywall310_firmware
- zyxel:zywall1100_firmware
- zyxel:atp100_firmware
- zyxel:atp100w_firmware
- zyxel:atp200_firmware
- zyxel:atp500_firmware
- zyxel:atp700_firmware
- zyxel:atp800_firmware
- zyxel:vpn50_firmware
- zyxel:vpn100_firmware
- zyxel:vpn300_firmware
- zyxel:vpn1000_firmware
- zyxel:usg_flex_100_firmware
- zyxel:usg_flex_100w_firmware
- zyxel:usg_flex_200_firmware
- zyxel:usg_flex_500_firmware
- zyxel:usg_flex_700_firmware

## References

- [other] https://www.zyxel.com/support/security_advisories.shtml
- [other] http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf
- [other] https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15
- [other] https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release
- [other] https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html
- [other] https://www.zyxel.com/support/CVE-2020-29583.shtml
- [other] https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.