CVE-2020-29583
published 2020-12-22CVE-2020-29583: Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found…
PriorityP199critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
90.05%
99.8th percentile
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zyxel | atp100_firmware | — | — |
| zyxel | atp100w_firmware | — | — |
| zyxel | atp200_firmware | — | — |
| zyxel | atp500_firmware | — | — |
| zyxel | atp700_firmware | — | — |
| zyxel | atp800_firmware | — | — |
| zyxel | usg1100_firmware | — | — |
| zyxel | usg110_firmware | — | — |
| zyxel | usg1900_firmware | — | — |
| zyxel | usg20-vpn_firmware | — | — |
| zyxel | usg20w-vpn_firmware | — | — |
| zyxel | usg210_firmware | — | — |
| zyxel | usg2200_firmware | — | — |
| zyxel | usg310_firmware | — | — |
| zyxel | usg40_firmware | — | — |
| zyxel | usg40w_firmware | — | — |
| zyxel | usg60_firmware | — | — |
| zyxel | usg60w_firmware | — | — |
| zyxel | usg_flex_100_firmware | — | — |
| zyxel | usg_flex_100w_firmware | — | — |
| zyxel | usg_flex_200_firmware | — | — |
| zyxel | usg_flex_500_firmware | — | — |
| zyxel | usg_flex_700_firmware | — | — |
| zyxel | vpn1000_firmware | — | — |
| zyxel | vpn100_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Shodan/FOFA/Google dork: search for exposed Zyxel USG FLEX 100 web interfaces using title-based queries to identify potentially vulnerable devices.
- →Successful exploitation of the hardcoded credential can be confirmed by detecting the presence of 'data-qtip="Web Console', 'CLI', and 'Configuration">' strings in the HTTP response body after authenticating with the zyfwp account.
- →Monitor SSH and web interface login attempts using the username 'zyfwp' on Zyxel USG/ATP/VM firewalls and NXC2500/NXC5500 AP controllers, as this undocumented account has an unchangeable hardcoded password. ↗
- →Monitor FTP traffic from Zyxel devices using the 'zyfwp' account, as it was originally designed for automatic firmware updates to connected access points via FTP and may be abused for lateral movement.
- ·The hardcoded password is unchangeable and present in cleartext within firmware version 4.60; patching requires a firmware update from the vendor. ↗
- ·The vulnerability affects multiple Zyxel product lines beyond USG, including ATP, VM firewalls, and NXC2500/NXC5500 AP controllers — detection and patching scope should be broadened accordingly. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-59jx-m3c4-2m9w: Firmware version 4
ghsa_unreviewed·2022-05-24
CVE-2020-29583 [HIGH] CWE-312 GHSA-59jx-m3c4-2m9w: Firmware version 4
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
VulnCheck
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
vulncheck·2020·CVSS 9.8
CVE-2020-29583 [CRITICAL] CWE-522 Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
Affected: Zyxel Multiple Products
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.cisa.gov/uscert/ncas/alerts/aa22-158a; https://cisa.gov/news-events/cybersecurity-advisories/aa22-158a
Exploit PoC: https://vulncheck.com/xdb/13164d2ee525
Remediation Due: 2022-05-03
CISA
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2020-29583 [CRITICAL] CWE-522 Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Vulnerability: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Affected: Zyxel Multiple Products
Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-29583
Remediation Due Date: 2022-05-03
No detection rules found.
Nuclei
ZyXel USG - Hardcoded Credentials
nuclei·CVSS 9.8
CVE-2020-29583 [CRITICAL] ZyXel USG - Hardcoded Credentials
ZyXel USG - Hardcoded Credentials
A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP.
Template:
id: CVE-2020-29583
info:
name: ZyXel USG - Hardcoded Credentials
author: canberbamber
severity: critical
description: |
A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP.
impact: |
An attacker can exploit this vulnerability to gain unauthorized access to the affected device, potentially leading to further compromise of the network.
remediation: |
No writeups or analysis indexed.
http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdfhttps://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-releasehttps://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.htmlhttps://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/https://www.zyxel.com/support/CVE-2020-29583.shtmlhttps://www.zyxel.com/support/security_advisories.shtmlhttp://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdfhttps://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-releasehttps://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.htmlhttps://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/https://www.zyxel.com/support/CVE-2020-29583.shtmlhttps://www.zyxel.com/support/security_advisories.shtmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583
2020-12-22
Published
2021-11-03
Added to CISA KEV
Exploited in the wild