CVE-2020-29583: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Published Dec 22, 2020 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
References
- https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release
- https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15
- https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html
- https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/
- https://www.zyxel.com/support/CVE-2020-29583.shtml
- https://www.zyxel.com/support/security_advisories.shtml
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Zyxel vulnerabilities
All Zyxel entriesCVE-2026-7273
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
high8.8ExploitedJun 16, 2026CVE-2024-40890
Zyxel DSL CPE OS Command Injection Vulnerability
high8.8ExploitedFeb 4, 2025CVE-2024-40891
Zyxel DSL CPE OS Command Injection Vulnerability
high8.8ExploitedFeb 4, 2025CVE-2024-11667
Zyxel Multiple Firewalls Path Traversal Vulnerability
critical9.8ExploitedNov 27, 2024CVE-2023-27992
Zyxel Multiple NAS Devices Command Injection Vulnerability
critical9.8ExploitedJun 19, 2023CVE-2023-33009
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
critical9.8ExploitedMay 24, 2023