ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2020-29583

Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

Published Dec 22, 2020 · catalog updated Jun 16, 2026 · Zyxel Multiple Products

Patch now

CVE-2020-29583 is in the CISA known-exploited catalog, due May 3, 2022. Confirm Zyxel Multiple Products against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity
Critical9.8
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
90.16%
Remediation
Remediation guidance
Affected products
cpe zyxel/usg110 firmware · cpe zyxel/usg1100 firmware · cpe zyxel/usg1900 firmware · cpe zyxel/usg20-vpn firmware · cpe zyxel/usg20w-vpn firmware · cpe zyxel/usg210 firmware

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe zyxel/usg110 firmware4.60
  • cpe zyxel/usg1100 firmware4.60
  • cpe zyxel/usg1900 firmware4.60
  • cpe zyxel/usg20-vpn firmware4.60
  • cpe zyxel/usg20w-vpn firmware4.60
  • cpe zyxel/usg210 firmware4.60
  • cpe zyxel/usg2200 firmware4.60
  • cpe zyxel/usg310 firmware4.60
  • cpe zyxel/usg40 firmware4.60
  • cpe zyxel/usg40w firmware4.60
  • cpe zyxel/usg60 firmware4.60
  • cpe zyxel/usg60w firmware4.60
  • vendor Zyxel Multiple Productsversion unspecified

How to fix CVE-2020-29583

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2020-29583 is in the CISA known-exploited catalog, due May 3, 2022. Confirm Zyxel Multiple Products against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with zyxel/usg110 firmware 4.60; zyxel/usg1100 firmware 4.60; zyxel/usg1900 firmware 4.60; zyxel/usg20-vpn firmware 4.60. Apply updates per vendor instructions.

What should an analyst verify?

CWE-522: Insufficiently Protected Credentials. EPSS 90.16%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 22, 2020 · Catalog

    Detected

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

Sources

  • CISA KEVConfirmed exploitationCVE-2020-29583

    Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2020-29583

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2020-29583

    30-day exploitation probability 90.2%

    first.org
  • NIST NVDVulnerability recordCVE-2020-29583

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin p

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2020-29583

    Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.