CVE-2020-29583

CVE-2020-29583 is a critical-severity (CVSS 9.8) vulnerability in Zyxel Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 3, 2022. CISA does not currently list it as used in ransomware campaigns. Zyxel has 13 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf
• https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release
• https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15
• https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html
• https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/
• https://www.zyxel.com/support/CVE-2020-29583.shtml
• https://www.zyxel.com/support/security_advisories.shtml
• http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf