CVE-2020-29583Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password.
Updated under an hour ago ()
Does this affect you?
It affects zyxel usg20-vpn_firmware and 29 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by May 3, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
- CVSS
- 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-522
- Known exploited
- Added to CISA KEV Nov 3, 2021; federal remediation due May 3, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 90.16% (percentile 100)
- Assigned by
- mitre
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
zyxel usg20-vpn_firmware zyxel:usg20-vpn_firmware | 4.60 | NVD |
zyxel usg20w-vpn_firmware zyxel:usg20w-vpn_firmware | 4.60 | NVD |
zyxel usg40_firmware zyxel:usg40_firmware | 4.60 | NVD |
zyxel usg40w_firmware zyxel:usg40w_firmware | 4.60 | NVD |
zyxel usg60_firmware zyxel:usg60_firmware | 4.60 | NVD |
zyxel usg60w_firmware zyxel:usg60w_firmware | 4.60 | NVD |
zyxel usg110_firmware zyxel:usg110_firmware | 4.60 | NVD |
zyxel usg210_firmware zyxel:usg210_firmware | 4.60 | NVD |
zyxel usg310_firmware zyxel:usg310_firmware | 4.60 | NVD |
zyxel usg1100_firmware zyxel:usg1100_firmware | 4.60 | NVD |
zyxel usg1900_firmware zyxel:usg1900_firmware | 4.60 | NVD |
zyxel usg2200_firmware zyxel:usg2200_firmware | 4.60 | NVD |
zyxel zywall110_firmware zyxel:zywall110_firmware | 4.60 | NVD |
zyxel zywall310_firmware zyxel:zywall310_firmware | 4.60 | NVD |
zyxel zywall1100_firmware zyxel:zywall1100_firmware | 4.60 | NVD |
zyxel atp100_firmware zyxel:atp100_firmware | 4.60 | NVD |
zyxel atp100w_firmware zyxel:atp100w_firmware | 4.60 | NVD |
zyxel atp200_firmware zyxel:atp200_firmware | 4.60 | NVD |
zyxel atp500_firmware zyxel:atp500_firmware | 4.60 | NVD |
zyxel atp700_firmware zyxel:atp700_firmware | 4.60 | NVD |
zyxel atp800_firmware zyxel:atp800_firmware | 4.60 | NVD |
zyxel vpn50_firmware zyxel:vpn50_firmware | 4.60 | NVD |
zyxel vpn100_firmware zyxel:vpn100_firmware | 4.60 | NVD |
zyxel vpn300_firmware zyxel:vpn300_firmware | 4.60 | NVD |
zyxel vpn1000_firmware zyxel:vpn1000_firmware | 4.60 | NVD |
zyxel usg_flex_100_firmware zyxel:usg_flex_100_firmware | 4.60 | NVD |
zyxel usg_flex_100w_firmware zyxel:usg_flex_100w_firmware | 4.60 | NVD |
zyxel usg_flex_200_firmware zyxel:usg_flex_200_firmware | 4.60 | NVD |
zyxel usg_flex_500_firmware zyxel:usg_flex_500_firmware | 4.60 | NVD |
zyxel usg_flex_700_firmware zyxel:usg_flex_700_firmware | 4.60 | NVD |
References
- https://www.zyxel.com/support/security_advisories.shtmlvendor-advisory
- http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdfbroken-link
- https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15release-notes
- https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-releaserelease-notes
- https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.htmlbroken-link, third-party-advisory
- https://www.zyxel.com/support/CVE-2020-29583.shtmlvendor-advisory
- https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/exploit, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.