VULNERABILITY INTELLIGENCE
CVE-2020-29583
CVSS score9.8 CRITICAL
EPSS probability90.16%
CISA KEVKnown exploited vulnerability
Published2020-12-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Exploited Vulnerability
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Vendor / product: Zyxel / Multiple Products
Description
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Weakness classification
- nvd@nist.gov: CWE-522
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-522
Primary references
- cve@mitre.org — Broken Link
- cve@mitre.org — Release Notes
- cve@mitre.org — Release Notes
- cve@mitre.org — Broken Link, Third Party Advisory
- cve@mitre.org — Exploit, Third Party Advisory
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory