CRITICAL

CVE-2020-29583

Zyxel Usg20 Vpn Firmware 2020-12-22 CVSS v3.1

CVSS

9.8

KEV

Description

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

Summary dbcve.org

Zyxel USG devices running firmware version 4.60 contain an undocumented administrative account (zyfwp) with a hardcoded, cleartext password embedded directly in the firmware image. Attackers who obtain the firmware through extraction or other means can use these credentials to authenticate to the device's SSH server or web interface with full admin privileges.

Mitigation

Upgrade to a patched firmware version that removes the undocumented account; if an immediate patch is unavailable, disable SSH and web interface access from untrusted networks and implement monitoring for unauthorized access attempts.

Proof of Concept

Weakness (CWE)

CWE-522 Insufficiently Protected Credentials

EPSS Score

90.16%

Probability of exploitation in next 30 days

99.8th percentile

References

http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf Broken Link https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release Release Notes https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15 Release Notes https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html Broken Link, Third Party Advisory https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/ Exploit, Third Party Advisory https://www.zyxel.com/support/CVE-2020-29583.shtml Vendor Advisory https://www.zyxel.com/support/security_advisories.shtml Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE