← Retour aux CVEs
CVE-2020-29583
CRITICALCISA KEV9.8
Description
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Details CVE
Score CVSS v3.19.8
SeveriteCRITICAL
Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vecteur d'attaqueNETWORK
ComplexiteLOW
Privileges requisNONE
Interaction utilisateurNONE
Publie12/22/2020
Derniere modification11/7/2025
Sourcekev
Observations honeypot0
CISA KEV
FournisseurZyxel
ProduitMultiple Products
Nom vulnerabiliteZyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Date ajout KEV2021-11-03
Date limite remediation2022-05-03
Utilise dans ransomwareUnknown
Produits affectes
zyxel:atp100zyxel:atp100_firmwarezyxel:atp100wzyxel:atp100w_firmwarezyxel:atp200zyxel:atp200_firmwarezyxel:atp500zyxel:atp500_firmwarezyxel:atp700zyxel:atp700_firmwarezyxel:atp800zyxel:atp800_firmwarezyxel:usg110zyxel:usg1100zyxel:usg1100_firmwarezyxel:usg110_firmwarezyxel:usg1900zyxel:usg1900_firmwarezyxel:usg20-vpnzyxel:usg20-vpn_firmwarezyxel:usg20w-vpnzyxel:usg20w-vpn_firmwarezyxel:usg210zyxel:usg210_firmwarezyxel:usg2200zyxel:usg2200_firmwarezyxel:usg310zyxel:usg310_firmwarezyxel:usg40zyxel:usg40_firmwarezyxel:usg40wzyxel:usg40w_firmwarezyxel:usg60zyxel:usg60_firmwarezyxel:usg60wzyxel:usg60w_firmwarezyxel:usg_flex_100zyxel:usg_flex_100_firmwarezyxel:usg_flex_100wzyxel:usg_flex_100w_firmwarezyxel:usg_flex_200zyxel:usg_flex_200_firmwarezyxel:usg_flex_500zyxel:usg_flex_500_firmwarezyxel:usg_flex_700zyxel:usg_flex_700_firmwarezyxel:vpn100zyxel:vpn1000zyxel:vpn1000_firmwarezyxel:vpn100_firmwarezyxel:vpn300zyxel:vpn300_firmwarezyxel:vpn50zyxel:vpn50_firmwarezyxel:zywall110zyxel:zywall1100zyxel:zywall1100_firmwarezyxel:zywall110_firmwarezyxel:zywall310zyxel:zywall310_firmware
Faiblesses (CWE)
CWE-522CWE-522
References
https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release(cve@mitre.org)
https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15(cve@mitre.org)
https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/(cve@mitre.org)
https://www.zyxel.com/support/CVE-2020-29583.shtml(cve@mitre.org)
https://www.zyxel.com/support/security_advisories.shtml(cve@mitre.org)
http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf(af854a3a-2127-422b-91ae-364da2661108)
https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release(af854a3a-2127-422b-91ae-364da2661108)
https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15(af854a3a-2127-422b-91ae-364da2661108)
https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/(af854a3a-2127-422b-91ae-364da2661108)
https://www.zyxel.com/support/CVE-2020-29583.shtml(af854a3a-2127-422b-91ae-364da2661108)
https://www.zyxel.com/support/security_advisories.shtml(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583(134c704f-9b21-4f2e-91b3-4a467353bcc0)
Correlations IOC
Aucune correlation enregistree
This product uses data from the NVD API but is not endorsed or certified by the NVD.