{"id":"CVE-2020-29583","kind":"vulnerability","aliases":["CVE-2020-29583"],"related":[],"title":"Zyxel Multiple Products: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability","description":"Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.","summary":"Zyxel firewalls (ATP, USG, USG FLEX, VPN) on ZLD V4.60 and NXC2500/NXC5500 AP controllers on V6.00-V6.10 contain a hardcoded account 'zyfwp', made for FTP firmware updates to APs. Its password is recoverable from the firmware, and the account has admin privileges. Zyxel patched it in Dec 2020 (firewalls) and Jan 2021 (AP controllers). Exploited in the wild per CISA KEV.","severity":"critical","cvss":10.0,"epss":0.90155,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Zyxel Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Zyxel ATP/USG/USG FLEX/VPN (ZLD)","fixed":["ZLD V4.60 Patch1"],"affected":"ZLD V4.60 before Patch1","ecosystem":"vendor"},{"name":"Zyxel NXC2500/NXC5500","fixed":["V6.10 Patch1"],"affected":"V6.00 through V6.10 before Patch1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firewall","infrastructure","self-hosted","usg","zyxel"],"not_affected_if":["managed-hosting","not-firmware-4.60"],"how_to_check":"Check firmware version in the web UI (Dashboard) or with 'show version' on the CLI: ZLD V4.60 without Patch1 on ATP/USG/USG FLEX/VPN, or NXC2500/NXC5500 V6.00-V6.10 without Patch1, is vulnerable. Look for a local user named 'zyfwp' in the configuration (e.g. 'show running-config' on the CLI). Treat unexpected admin logins or FTP/SSH access as possible compromise.","fix":"Install ZLD V4.60 Patch1 or later on ATP, USG, USG FLEX and VPN series. Install V6.10 Patch1 or later on NXC2500 and NXC5500. Also remove or disable the zyfwp account where possible, and don't expose SSH, FTP or the web admin to the internet.","status":"open","published_at":"2020-12-22T22:15:14+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:25+00:00","updated_at":"2026-10-23T20:30:28+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T20:29:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"Zyxel USG firewalls running firmware 4.60 ship with a hidden account named zyfwp that has a fixed password recoverable from the firmware image. An attacker who knows it can log in over SSH or the web interface with admin privileges.","category":"infrastructure","who_cares":["zyxel","usg","firewall","self-hosted"],"confidence":0.8,"analyst_note":"Sources do not name the fixed firmware version or a check command; confirm patched versions and zyfwp account handling in the Zyxel advisory and CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-firmware-4.60","managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000347,"input_tokens":2155,"output_tokens":264,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not name the fixed firmware version or a check command; confirm patched versions and zyfwp account handling in the Zyxel advisory and CISA KEV entry.","search":"'-2020':15A,18A '-29583':16A,19A '2020':83B '2021':87B '4.60':99C 'account':56B,74B,107C,117C,127C 'admin':76B,143C 'ap':49B,64B,88B 'atp':39B 'atp/usg/usg':24A 'cisa':95B 'cleartext':122C 'code':11A 'contain':53B,104C 'control':50B,89B 'credenti':12A 'cve':14A,17A 'dec':82B 'devic':103C 'exploit':29B,90B 'firewal':30B,38B,84B 'firmwar':61B,71B,97C,125C 'flex':42B 'flex/vpn':25A 'found':120C 'ftp':60B 'hard':10A 'hard-cod':9A 'hardcod':55B 'host':34B 'infrastructur':31B 'interfac':141C 'jan':86B 'kev':96B 'login':134C 'made':58B 'multipl':2A,5A 'multiple':21A 'nxc2500/nxc5500':28A,48B 'password':66B,112C,114C 'patch':79B 'per':94B 'privileg':77B,144C 'product':3A,6A 'products':22A 'recover':68B 'self':33B 'self-host':32B 'server':138C 'someon':132C 'ssh':137C 'unchang':111C 'undocu':106C 'updat':62B 'use':7A,130C 'usg':35B,40B,41B,102C 'v4.60':46B 'v6.00-v6.10':52B 'version':98C 'vpn':43B 'vulner':13A 'web':140C 'wild':93B 'zld':26A,45B 'zyfwp':57B,108C 'zyxel':1A,4A,20A,23A,27A,36B,37B,78B,101C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-12-22T22:15:14+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-29583","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-29583","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T12:39:26+00:00","note":null},{"source":"epss","external_id":"CVE-2020-29583","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-29583","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-29583","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-29583","severity":null,"published_at":"2020-12-22T22:15:14+00:00","modified_at":"2026-06-17T03:11:28+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2020-29583:15","url":null,"severity":null,"published_at":"2026-10-23T20:30:28+00:00","modified_at":"2026-10-23T20:30:28+00:00","first_seen_at":"2026-10-23T20:30:28+00:00","fetched_at":"2026-10-23T20:30:28+00:00","note":"Zyxel advisory (read directly) lists fixed versions: ZLD V4.60 Patch1 for ATP/USG/USG FLEX/VPN, V6.10 Patch1 for NXC2500/NXC5500. Listed in CISA KEV as exploited (per triage). Public PoC link not checked."}],"documents":[{"id":838,"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-hardcoded-credential-vulnerability","title":"Zyxel security advisory for hardcoded credential vulnerability","kind":"advisory","source":"analyst","text":"Zyxel advisory CVE-2020-29583: hardcoded \"zyfwp\" account (FTP firmware updates to APs). Affected: ATP, USG, USG FLEX, VPN series on ZLD V4.60 -> fixed ZLD V4.60 Patch1 (Dec 2020). NXC2500 and NXC5500 on V6.00 through V6.10 -> V6.10 Patch1 (Jan 8, 2021). Reported by Niels Teusink at EYE. Products not listed are not affected.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":838,"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-hardcoded-credential-vulnerability","title":"Zyxel security advisory for hardcoded credential vulnerability","kind":"advisory","source":"analyst","text":"Zyxel advisory CVE-2020-29583: hardcoded \"zyfwp\" account (FTP firmware updates to APs). Affected: ATP, USG, USG FLEX, VPN series on ZLD V4.60 -> fixed ZLD V4.60 Patch1 (Dec 2020). NXC2500 and NXC5500 on V6.00 through V6.10 -> V6.10 Patch1 (Jan 8, 2021). Reported by Niels Teusink at EYE. Products not listed are not affected.","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}