CVE-2020-29583

תיאור (מקור, אנגלית)

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

מדדים

CVSS 3.1

9.8 (CRITICAL) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

90% (אחוזון 100) נכון ל-30/7/2026

CWE

CWE-522

מוצרים מושפעים

zyxel: usg20-vpn firmware; zyxel: usg20-vpn; zyxel: usg20w-vpn firmware; zyxel: usg20w-vpn; zyxel: usg40 firmware; zyxel: usg40; zyxel: usg40w firmware; zyxel: usg40w; zyxel: usg60 firmware; zyxel: usg60; zyxel: usg60w firmware; zyxel: usg60w; zyxel: usg110 firmware; zyxel: usg110; zyxel: usg210 firmware

קישורים

• https://www.zyxel.com/support/CVE-2020-29583.shtml Vendor Advisory
• https://www.zyxel.com/support/security_advisories.shtml Vendor Advisory
• https://www.zyxel.com/support/CVE-2020-29583.shtml Vendor Advisory
• https://www.zyxel.com/support/security_advisories.shtml Vendor Advisory
• https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-a‮… ExploitThird Party Advisory
• https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-a‮… ExploitThird Party Advisory
• http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf Broken Link
• https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firm‮… Release Notes
• https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-‮… Release Notes
• https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html Broken LinkThird Party Advisory