Live › vulnerability › CVE-2020-29583
Go to dashboardZyxel firewalls (ATP, USG, USG FLEX, VPN) on ZLD V4.60 and NXC2500/NXC5500 AP controllers on V6.00-V6.10 contain a hardcoded account 'zyfwp', made for FTP firmware updates to APs. Its password is recoverable from the firmware, and the account has admin privileges. Zyxel patched it in Dec 2020 (firewalls) and Jan 2021 (AP controllers). Exploited in the wild per CISA KEV.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 0h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Zyxel Multiple Products | vendor | – | – |
| Zyxel ATP/USG/USG FLEX/VPN (ZLD) | vendor | ZLD V4.60 before Patch1 | ZLD V4.60 Patch1 |
| Zyxel NXC2500/NXC5500 | vendor | V6.00 through V6.10 before Patch1 | V6.10 Patch1 |
show version on the CLI: ZLD V4.60 without Patch1 on ATP/USG/USG FLEX/VPN, or NXC2500/NXC5500 V6.00-V6.10 without Patch1, is vulnerablezyfwp in the configuration (e.g. show running-config on the CLI)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
This page as .md · .json · in your agent: get_signal("CVE-2020-29583")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.