---
id: "CVE-2020-29583"
kind: "vulnerability"
aliases: ["CVE-2020-29583"]
title: "Zyxel Multiple Products: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.90155
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Zyxel Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Zyxel ATP/USG/USG FLEX/VPN (ZLD)", "fixed": ["ZLD V4.60 Patch1"], "affected": "ZLD V4.60 before Patch1", "ecosystem": "vendor"}, {"name": "Zyxel NXC2500/NXC5500", "fixed": ["V6.10 Patch1"], "affected": "V6.00 through V6.10 before Patch1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "firewall", "infrastructure", "self-hosted", "usg", "zyxel"]
not_affected_if: ["managed-hosting", "not-firmware-4.60"]
published_at: "2020-12-22T22:15:14+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:30:28+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-29583", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-29583", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29583", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:30:28+00:00"}]
---

# Zyxel Multiple Products: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

Zyxel firewalls (ATP, USG, USG FLEX, VPN) on ZLD V4.60 and NXC2500/NXC5500 AP controllers on V6.00-V6.10 contain a hardcoded account 'zyfwp', made for FTP firmware updates to APs. Its password is recoverable from the firmware, and the account has admin privileges. Zyxel patched it in Dec 2020 (firewalls) and Jan 2021 (AP controllers). Exploited in the wild per CISA KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zyxel Multiple Products affected ? fixed ?
- vendor:Zyxel ATP/USG/USG FLEX/VPN (ZLD) affected ZLD V4.60 before Patch1 fixed ZLD V4.60 Patch1
- vendor:Zyxel NXC2500/NXC5500 affected V6.00 through V6.10 before Patch1 fixed V6.10 Patch1

## How to check

Check firmware version in the web UI (Dashboard) or with 'show version' on the CLI: ZLD V4.60 without Patch1 on ATP/USG/USG FLEX/VPN, or NXC2500/NXC5500 V6.00-V6.10 without Patch1, is vulnerable. Look for a local user named 'zyfwp' in the configuration (e.g. 'show running-config' on the CLI). Treat unexpected admin logins or FTP/SSH access as possible compromise.

## Fix

Install ZLD V4.60 Patch1 or later on ATP, USG, USG FLEX and VPN series. Install V6.10 Patch1 or later on NXC2500 and NXC5500. Also remove or disable the zyfwp account where possible, and don't expose SSH, FTP or the web admin to the internet.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-29583
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-29583
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-29583
- 2026-10-23T20:30:28+00:00 analyst — Zyxel advisory (read directly) lists fixed versions: ZLD V4.60 Patch1 for ATP/USG/USG FLEX/VPN, V6.10 Patch1 for NXC2500/NXC5500. Listed in CISA KEV as exploited (per triage). Public PoC link not checked.

## Documents

- [advisory] Zyxel security advisory for hardcoded credential vulnerability https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-hardcoded-credential-vulnerability
- [fix] Zyxel security advisory for hardcoded credential vulnerability https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-hardcoded-credential-vulnerability

## From the sources

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_