Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2020-29583 · Published 22/12/2020 · updated 17/06/2026

Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
Multiple Products Zyxel	Versions not published yet (product named by CISA KEV)

Description

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

References

ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf · Broken Link
businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release · Release Notes
businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15 · Release Notes
eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html · Broken Link
secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583 · Exploit
zyxel.com/support/CVE-2020-29583.shtml · Vendor Advisory
zyxel.com/support/security_advisories.shtml · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-29583

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free