{"id":"CVE-2020-29583","published":"2020-12-22T22:15:14Z","modified":"2026-06-17T03:11:28Z","title":"Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability","vendor":"Zyxel","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.","provenance":"source","from":"NVD"},"summary":{"text":"Zyxel multiple products contain a hard-coded credential flaw: firmware version 4.60 of Zyxel USG devices includes an undocumented account (zyfwp) whose unchangeable password is stored in cleartext in the firmware. An attacker who knows or extracts that password can log in over the SSH server or web interface with administrator privileges, requiring only network access and no authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:33Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.90155,"percentile":0.99796,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-29583","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-11-03","exploitedFirstSeen":"2021-11-03","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-158a","date":"2022-06-07"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-158a","date":"2022-06-10"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf","tags":["Broken Link"]},{"url":"https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release","tags":["Release Notes"]},{"url":"https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15","tags":["Release Notes"]},{"url":"https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.zyxel.com/support/CVE-2020-29583.shtml","tags":["Vendor Advisory"]},{"url":"https://www.zyxel.com/support/security_advisories.shtml","tags":["Vendor Advisory"]},{"url":"http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf","tags":["Broken Link"]},{"url":"https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release","tags":["Release Notes"]},{"url":"https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15","tags":["Release Notes"]},{"url":"https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.zyxel.com/support/CVE-2020-29583.shtml","tags":["Vendor Advisory"]},{"url":"https://www.zyxel.com/support/security_advisories.shtml","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Hardcoded account credentials enable direct login","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"contains an undocumented account (zyfwp) with an unchangeable password","start":43,"end":113}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-21944","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21944","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2021-01-04","earliestUrl":"https://github.com/ruppde/scan_CVE-2020-29583","repos":[{"name":"ruppde/scan_CVE-2020-29583","url":"https://github.com/ruppde/scan_CVE-2020-29583","stars":16,"created":"2021-01-04"}]},"nuclei":[{"id":"CVE-2020-29583","name":"ZyXel USG - Hardcoded Credentials","severity":"critical","path":"http/cves/2020/CVE-2020-29583.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29583.yaml"}],"first":{"date":"2021-01-04","source":"PoC-in-GitHub","url":"https://github.com/ruppde/scan_CVE-2020-29583"},"provenance":"source"},"exploitRefs":["https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2020-12-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-29583","provenance":"source"},{"date":"2021-01-04","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ruppde/scan_CVE-2020-29583","provenance":"source"},{"date":"2021-11-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21944","provenance":"source"}],"speed":{"daysToPublicExploit":13,"firstExploitFrom":"PoC-in-GitHub","daysToKev":316},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1821 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9980"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}