Critical severity · published Dec 22, 2020
CVE-2020-29583
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
In wildKEV
9.8
CVSS
90.2%
EPSS
Yes
On KEV
Description
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)90.2% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
AF
Atp100 Firmware · Zyxel
4.60 · source: NVD
AF
Atp100w Firmware · Zyxel
4.60 · source: NVD
AF
Atp200 Firmware · Zyxel
4.60 · source: NVD
AF
Atp500 Firmware · Zyxel
4.60 · source: NVD
AF
Atp700 Firmware · Zyxel
4.60 · source: NVD
AF
Atp800 Firmware · Zyxel
4.60 · source: NVD
UF
Usg Flex 100 Firmware · Zyxel
4.60 · source: NVD
UF
Usg Flex 100w Firmware · Zyxel
4.60 · source: NVD
UF
Usg Flex 200 Firmware · Zyxel
4.60 · source: NVD
UF
Usg Flex 500 Firmware · Zyxel
4.60 · source: NVD
UF
Usg Flex 700 Firmware · Zyxel
4.60 · source: NVD
UF
Usg110 Firmware · Zyxel
4.60 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-29583
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-29583
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.zyxel.com
https://www.zyxel.com/support/security_advisories.shtml
ftp.zyxel.com
http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf
businessforum.zyxel.com
https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15
businessforum.zyxel.com
https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release
www.eyecontrol.nl
https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html
www.zyxel.com
https://www.zyxel.com/support/CVE-2020-29583.shtml
More from Atp100 Firmware
9.8
CVE-2024-11667
Zyxel Multiple Firewalls Path Traversal Vulnerability
9.8
CVE-2023-33009
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
9.8
CVE-2023-33010
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
9.8
CVE-2023-28771
Zyxel Multiple Firewalls OS Command Injection Vulnerability
9.8
CVE-2022-30525
Zyxel Multiple Firewalls OS Command Injection Vulnerability