CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2020-29583

CVSS 9.8v3.1pub. 2020-12-22upd. 2025-11-07

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Zyxel Atp100
HW
Zyxel
all versions
Zyxel Atp100 Firmware
OS
Zyxel
4.60
Zyxel Atp100w
HW
Zyxel
all versions
Zyxel Atp100w Firmware
OS
Zyxel
4.60
Zyxel Atp200
HW
Zyxel
all versions
Zyxel Atp200 Firmware
OS
Zyxel
4.60
Zyxel Atp500
HW
Zyxel
all versions
Zyxel Atp500 Firmware
OS
Zyxel
4.60
Zyxel Atp700
HW
Zyxel
all versions
Zyxel Atp700 Firmware
OS
Zyxel
4.60
Zyxel Atp800
HW
Zyxel
all versions
Zyxel Atp800 Firmware
OS
Zyxel
4.60
Zyxel Usg110
HW
Zyxel
all versions
Zyxel Usg1100
HW
Zyxel
all versions
Zyxel Usg1100 Firmware
OS
Zyxel
4.60
Zyxel Usg110 Firmware
OS
Zyxel
4.60
Zyxel Usg1900
HW
Zyxel
all versions
Zyxel Usg1900 Firmware
OS
Zyxel
4.60
Zyxel Usg20 Vpn
HW
Zyxel
all versions
Zyxel Usg20 Vpn Firmware
OS
Zyxel
4.60
Zyxel Usg20w Vpn
HW
Zyxel
all versions
Zyxel Usg20w Vpn Firmware
OS
Zyxel
4.60
Zyxel Usg210
HW
Zyxel
all versions
Zyxel Usg210 Firmware
OS
Zyxel
4.60
Zyxel Usg2200
HW
Zyxel
all versions
Zyxel Usg2200 Firmware
OS
Zyxel
4.60
Zyxel Usg310
HW
Zyxel
all versions
Zyxel Usg310 Firmware
OS
Zyxel
4.60
Zyxel Usg40
HW
Zyxel
all versions
Zyxel Usg40 Firmware
OS
Zyxel
4.60

CISA KEV — detailsi

Vendori: Zyxel
Producti: Multiple Products
Added to KEVi: November 3, 2021
Remediation deadline (US Federal)i: May 3, 2022(overdue)

🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

🔴