9.8Critical
KEV
CVE-2020-29583Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Known exploited — Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-29583
Description
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Weakness (CWE):
CWE-522
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| zyxel | atp100 firmware | 4.60 | |
| zyxel | atp100w firmware | 4.60 | |
| zyxel | atp200 firmware | 4.60 | |
| zyxel | atp500 firmware | 4.60 | |
| zyxel | atp700 firmware | 4.60 | |
| zyxel | atp800 firmware | 4.60 | |
| zyxel | usg flex 100 firmware | 4.60 | |
| zyxel | usg flex 100w firmware | 4.60 | |
| zyxel | usg flex 200 firmware | 4.60 | |
| zyxel | usg flex 500 firmware | 4.60 | |
| zyxel | usg flex 700 firmware | 4.60 | |
| zyxel | usg110 firmware | 4.60 | |
| zyxel | usg1100 firmware | 4.60 | |
| zyxel | usg1900 firmware | 4.60 | |
| zyxel | usg20-vpn firmware | 4.60 | |
| zyxel | usg20w-vpn firmware | 4.60 | |
| zyxel | usg210 firmware | 4.60 | |
| zyxel | usg2200 firmware | 4.60 | |
| zyxel | usg310 firmware | 4.60 | |
| zyxel | usg40 firmware | 4.60 | |
| zyxel | usg40w firmware | 4.60 | |
| zyxel | usg60 firmware | 4.60 | |
| zyxel | usg60w firmware | 4.60 | |
| zyxel | vpn100 firmware | 4.60 | |
| zyxel | vpn1000 firmware | 4.60 | |
| zyxel | vpn300 firmware | 4.60 | |
| zyxel | vpn50 firmware | 4.60 | |
| zyxel | zywall110 firmware | 4.60 | |
| zyxel | zywall1100 firmware | 4.60 | |
| zyxel | zywall310 firmware | 4.60 |
References and patches
- https://www.zyxel.com/support/security_advisories.shtml Vendor Advisory
- http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf Broken Link
- https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15 Release Notes
- https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release Release Notes
- https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html Broken LinkThird Party Advisory
- https://www.zyxel.com/support/CVE-2020-29583.shtml Vendor Advisory
- https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-… ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583 US Government Resource
CPE matches (NVD) (30)
cpe:2.3:o:zyxel:usg20-vpn_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg20w-vpn_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg40_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg40w_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg60_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg60w_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg110_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg210_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg310_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg1100_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg1900_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg2200_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:zywall110_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:zywall310_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:zywall1100_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:atp100_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:atp100w_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:atp200_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:atp500_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:atp700_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:atp800_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vpn50_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vpn100_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vpn300_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:vpn1000_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg_flex_100_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg_flex_100w_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg_flex_200_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg_flex_500_firmware:4.60:*:*:*:*:*:*:*cpe:2.3:o:zyxel:usg_flex_700_firmware:4.60:*:*:*:*:*:*:*