Security readout for executives and security teams
Plain-English summary
CVE-2020-29583 is a critical Zyxel firmware issue where an undocumented administrator account existed with a fixed password. If reachable through SSH or the web interface, an attacker could gain full administrative control of the device.
Executive priority
Prioritize this as an urgent perimeter-device risk. A vulnerable internet-accessible firewall can become a direct path to network compromise, and CISA confirms known exploitation.
Technical view
Firmware version 4.60 of Zyxel USG devices included an undocumented zyfwp account with an unchangeable password stored in cleartext in firmware. The account could authenticate to SSH or the web interface with admin privileges. CVSS is 9.8.
Likely exposure
The clearest exposure is Zyxel USG devices running firmware 4.60, especially where SSH or web management is network-accessible. The bundle's structured affected-product list is n/a, so confirm exact models and fixed versions against Zyxel advisories.
Exploitation context
CISA lists CVE-2020-29583 in the Known Exploited Vulnerabilities catalog, so treat exploitation as confirmed. Public reporting also described the undocumented account and administrative access risk. No exploit procedure is needed to assess urgency.
Researcher notes
Key evidence supports hardcoded administrative credentials in Zyxel USG firmware 4.60 and CISA KEV status. The source bundle does not provide a complete affected-product matrix, so avoid broad product claims without vendor confirmation.
Mitigation direction
- Inventory Zyxel USG devices and identify any running firmware version 4.60.
- Follow Zyxel's CVE-2020-29583 advisory and install the vendor-recommended fixed firmware.
- Restrict SSH and web management access to trusted administrative networks only.
- Disable unnecessary remote management exposure until firmware status is confirmed.
- Review administrative accounts, configuration changes, and access logs for suspicious activity.
Validation and detection
- Confirm firmware versions from device management records or administrative interfaces.
- Verify SSH and web administration are not exposed to untrusted networks.
- Check whether Zyxel's CVE-2020-29583 guidance has been applied.
- Review logs for unexpected administrative logins around and after disclosure.
- Document models checked, firmware versions, and remediation status.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-522: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-29583 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.zyxel.com/support/security_advisories.shtmlCVE reference
- https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15CVE reference
- https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-releaseCVE reference
- https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.htmlCVE reference
- https://www.zyxel.com/support/CVE-2020-29583.shtmlCVE reference
- https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficiently Protected Credentials
Insufficiently Protected Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.