CVE-2020-29583
Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
Vulnerability Description
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Affected Platforms (CPE)
💻
Zyxel
Usg20 Vpn Firmware
= 4.60💻
Zyxel
Usg20w Vpn Firmware
= 4.60💻
Zyxel
Usg40 Firmware
= 4.60💻
Zyxel
Usg40w Firmware
= 4.60💻
Zyxel
Usg60 Firmware
= 4.60💻
Zyxel
Usg60w Firmware
= 4.60💻
Zyxel
Usg110 Firmware
= 4.60💻
Zyxel
Usg210 Firmware
= 4.60💻
Zyxel
Usg310 Firmware
= 4.60💻
Zyxel
Usg1100 Firmware
= 4.60💻
Zyxel
Usg1900 Firmware
= 4.60💻
Zyxel
Usg2200 Firmware
= 4.60💻
Zyxel
Zywall110 Firmware
= 4.60💻
Zyxel
Zywall310 Firmware
= 4.60💻
Zyxel
Zywall1100 Firmware
= 4.60💻
Zyxel
Atp100 Firmware
= 4.60💻
Zyxel
Atp100w Firmware
= 4.60💻
Zyxel
Atp200 Firmware
= 4.60💻
Zyxel
Atp500 Firmware
= 4.60💻
Zyxel
Atp700 Firmware
= 4.60💻
Zyxel
Atp800 Firmware
= 4.60💻
Zyxel
Vpn50 Firmware
= 4.60💻
Zyxel
Vpn100 Firmware
= 4.60💻
Zyxel
Vpn300 Firmware
= 4.60💻
Zyxel
Vpn1000 Firmware
= 4.60💻
Zyxel
Usg Flex 100 Firmware
= 4.60💻
Zyxel
Usg Flex 100w Firmware
= 4.60💻
Zyxel
Usg Flex 200 Firmware
= 4.60💻
Zyxel
Usg Flex 500 Firmware
= 4.60💻
Zyxel