CVE-2020-29583
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Description
CVE-2020-29583 is a critical use of hard-coded credentials vulnerability affecting multiple Zyxel firewall and access point controller products. Firmware version 4.60 of Zyxel USG devices contains an undocumented account ("zyfwp") with an unchangeable password that is stored in cleartext within the firmware. An attacker can use these hard-coded credentials to log into the SSH server or web management interface with full administrative privileges. CISA has added CVE-2020-29583 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 94.37% (99.96th percentile), this Zyxel hard-coded credentials vulnerability represents a severe risk to organizations running affected firewall firmware.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zyxel | usg20-vpn firmware | 4.60 |
| zyxel | usg20w-vpn firmware | 4.60 |
| zyxel | usg40 firmware | 4.60 |
| zyxel | usg40w firmware | 4.60 |
| zyxel | usg60 firmware | 4.60 |
| zyxel | usg60w firmware | 4.60 |
| zyxel | usg110 firmware | 4.60 |
| zyxel | usg210 firmware | 4.60 |
| zyxel | usg310 firmware | 4.60 |
| zyxel | usg1100 firmware | 4.60 |
| zyxel | usg1900 firmware | 4.60 |
| zyxel | usg2200 firmware | 4.60 |
| zyxel | zywall110 firmware | 4.60 |
| zyxel | zywall310 firmware | 4.60 |
| zyxel | zywall1100 firmware | 4.60 |
| zyxel | atp100 firmware | 4.60 |
| zyxel | atp100w firmware | 4.60 |
| zyxel | atp200 firmware | 4.60 |
| zyxel | atp500 firmware | 4.60 |
| zyxel | atp700 firmware | 4.60 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf(Broken Link)
- https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release(Release Notes)
- https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15(Release Notes)
- https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html(Broken Link, Third Party Advisory)
- https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/(Exploit, Third Party Advisory)
- https://www.zyxel.com/support/CVE-2020-29583.shtml(Vendor Advisory)
- https://www.zyxel.com/support/security_advisories.shtml(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583(US Government Resource)
Weakness Type
CWE-522: Insufficiently Protected Credentials
CWE-522 occurs when an application stores or transmits credentials in a manner that allows unauthorized access. In CVE-2020-29583, Zyxel firmware version 4.60 contains a hard-coded, undocumented user account with cleartext credentials embedded directly in the firmware image. This insufficiently protected credential allows any attacker who obtains the firmware or discovers the account to gain full administrative access to the affected device.
Learn more: CWE-522 — Insufficiently Protected Credentials
Impact Analysis
CVE-2020-29583 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting the maximum exploitability and severe impact. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, as the hard-coded credentials provide immediate administrative access. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, granting the attacker full administrative control over the Zyxel firewall or access point controller. The EPSS score of 94.37% (99.96th percentile) indicates near-certain exploitation activity. Since Zyxel firewalls serve as perimeter security devices protecting entire networks, compromise of these devices can give attackers unrestricted access to internal networks, making this vulnerability exceptionally dangerous for organizations relying on affected Zyxel products for their network security.
Exploit Maturity
CVE-2020-29583 has a mature exploit landscape with confirmed active exploitation. CISA has confirmed active exploitation in the wild through its KEV catalog listing. Public exploit information is available via SecPod, which provides detailed technical analysis of the hard-coded credential attack. The nature of this vulnerability is particularly concerning because exploitation requires no specialized tooling: an attacker simply needs to use the publicly known username and password to authenticate via SSH or the web interface. The EPSS score of 94.37% (99.96th percentile) indicates near-certain exploitation activity, consistent with the trivial nature of exploiting hard-coded credentials in network perimeter devices. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA binding operational directive.
Remediation
- Apply firmware updates immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade all affected Zyxel devices to firmware version 4.60 Patch 1 or later, which removes the hard-coded "zyfwp" account. Consult the official Zyxel security advisory at https://www.zyxel.com/support/CVE-2020-29583.shtml for device-specific firmware downloads.
- Verify that all affected Zyxel product lines have been updated, including: USG series (USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200), ZyWALL series (ZyWALL110, ZyWALL310, ZyWALL1100), and ATP series (ATP100, ATP100W, ATP200, ATP500, ATP700) — all running firmware version 4.60.
- If immediate firmware update is not possible, restrict SSH and web management access to the affected devices from trusted administrative IP addresses only. Block external access to SSH (port 22) and the web interface (ports 80/443) using upstream network access controls.
- Review authentication logs on affected devices for unauthorized access using the "zyfwp" account. Investigate any suspicious administrative sessions, configuration changes, or VPN tunnel modifications that may indicate prior compromise.
- Implement long-term hardening measures including mandatory firmware update policies for network perimeter devices, regular credential audits to detect hard-coded or default accounts, network segmentation to limit the blast radius of compromised perimeter devices, and monitoring solutions that alert on authentication events from unexpected accounts.
Technical Details
CVE-2020-29583 exploits hard-coded credentials classified under CWE-522 (Insufficiently Protected Credentials) in Zyxel USG, ZyWALL, and ATP series firmware version 4.60. The firmware contains an undocumented user account named "zyfwp" with a static, unchangeable password stored in cleartext within the firmware binary. This account has full administrative privileges and can authenticate via both the SSH server and the web management interface. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that exploitation requires no prior authentication (the hard-coded credentials serve as the authentication) and is achievable over the network with trivial complexity. The cleartext nature of the credentials means any party with access to the firmware image, which is publicly downloadable, can extract and use the credentials to gain full administrative control over any affected device.
Frequently Asked Questions
Is CVE-2020-29583 being actively exploited?
Yes. CVE-2020-29583 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The trivial nature of exploitation (using publicly known hard-coded credentials) and the EPSS score of 94.37% (99.96th percentile) indicate widespread and near-certain exploitation activity.
What products are affected by CVE-2020-29583?
CVE-2020-29583 affects a wide range of Zyxel products running firmware version 4.60, including the USG series (USG20-VPN through USG2200), ZyWALL series (ZyWALL110, ZyWALL310, ZyWALL1100), and ATP series (ATP100, ATP100W, ATP200, ATP500, ATP700). Zyxel NXC2500 and NXC5500 AP controllers are also affected.
How do I fix CVE-2020-29583?
Update all affected Zyxel devices to firmware version 4.60 Patch 1 or later, which removes the hard-coded "zyfwp" account. Download the updated firmware from the official Zyxel security advisory page. If immediate patching is not possible, restrict SSH and web management access to trusted administrative networks only.
How severe is CVE-2020-29583?
CVE-2020-29583 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score in the 99.96th percentile. The vulnerability provides immediate administrative access to network perimeter security devices using publicly known hard-coded credentials, making it one of the most trivially exploitable and dangerous vulnerabilities affecting enterprise firewall infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.