PT-2020-5736 · Zyxel · Zyxel Usg

Niels Teusink

·

Published

2020-11-29

·

Updated

2025-11-07

·

CVE-2020-29583

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: Zyxel USG devices version 4.60
Description: The issue concerns an undocumented account zyfwp with an unchangeable password that can be found in cleartext in the firmware of Zyxel USG devices. This account allows someone to login to the ssh server or web interface with admin privileges. The password for this account is PrOw!aN fXp. There is a significant increase in attempts to access this known SSH backdoor using these undocumented credentials.
Recommendations: For Zyxel USG devices version 4.60, consider disabling the zyfwp account until a patch is available. Restrict access to the ssh server and web interface to minimize the risk of exploitation. Avoid using the zyfwp account and its associated password PrOw!aN fXp until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522CWE-312

Related Identifiers

BDU:2021-01667
CVE-2020-29583

Affected Products

Zyxel Usg