Zyxel Firewalls and AP Controllers Hardcoded Admin Credentials Vulnerability (CVE-2020-29583) Analysis & Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTZyxel USG, ATP, VPN, and ZyWALL series firewalls and AP controllers running ZLD firmware version 4.60
Remote attackers can gain full administrative access to the device's SSH server or web interface using an undocumented hardcoded account ('zyfwp')
Immediately upgrade to ZLD v4.60 Patch 1 or later, and restrict WAN-side access to management interfaces (SSH/HTTPS).
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is upgrading the device firmware to ZLD v4.60 Patch 1 or later, which removes the hardcoded account. Use the following CLI/FTP procedure to apply the patch:
# 1. Connect to the Zyxel device via FTP and upload the patched firmware binary
ftp <Zyxel_Device_IP>
# Enter credentials and switch to binary mode
bin
# Upload the firmware file (e.g., 460AALA1C0.bin)
put 460AALA1C0.bin
bye
# 2. Verify the firmware version after the device reboots
show version2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, restrict administrative access from the WAN interface using firewall rules to block SSH and HTTPS traffic.
# Block WAN-to-ZyWALL management traffic via Zyxel CLI
configure terminal
# Deny SSH access from WAN to the device
secure-policy 1
action deny
from WAN
to ZyWALL
service SSH
exit
# Deny HTTPS access from WAN to the device
secure-policy 2
action deny
from WAN
to ZyWALL
service HTTPS
exit
write3. Log Audit & IoC Verification Commands
Inspect the system logs to determine if the 'zyfwp' account has been used to access the device.
# Search syslog for any authentication attempts using the 'zyfwp' account\show logging target syslog | match 'zyfwp'
# Check specifically for successful logins via the backdoor account
show logging target syslog | match 'User zyfwp logged in'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-29583) stems from an undocumented, hardcoded administrative account ('zyfwp') embedded within the ZLD (Zyxel Liberty Distribution) firmware version 4.60. The account was designed to deliver firmware updates to connected access points, but its static password was stored in cleartext within the firmware binary, making it easily retrievable.
2. Exploitation Mechanics & Attack Scenario
An attacker can extract the cleartext password of the 'zyfwp' account by reverse-engineering the publicly available firmware image. Since this account possesses administrative privileges, the attacker does not need to exploit any memory corruption or complex logic flaws. Simply establishing a connection to the device's WAN-facing SSH (22/tcp) or SSL VPN/Web GUI (443/tcp) and authenticating with the hardcoded credentials grants immediate root-level access.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and its inclusion in the CISA KEV catalog, this vulnerability represents an extreme risk. Compromising a perimeter firewall allows threat actors to bypass all network security controls, intercept internal traffic, establish persistent VPN tunnels, pivot to internal subnets, and launch devastating ransomware or espionage campaigns across the entire corporate infrastructure.
Official Vendor Advisories & References
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Frequently Asked SecOps Questions (CVE-2020-29583)
FAQQ1. How critical is CVE-2020-29583 and is it actively exploited in the wild?
CVE-2020-29583 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 90.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-29583?
Primary impacted vendors include zyxel across usg, atp, vpn, zywall. Scope summary: Zyxel USG, ATP, VPN, and ZyWALL series firewalls running ZLD firmware v4.60, as well as affected AP controller series
Q3. What temporary mitigations or workarounds exist for CVE-2020-29583 before patching?
[Mitigation] Immediately upgrade to ZLD v4.60 Patch 1 or later, and restrict WAN-side access to management interfaces (SSH/HTTPS). Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-29583
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (zyxel)
View Category →Zyxel GS1900 Series Switch CGI Stack-based Buffer Overflow Remote Code Execution (RCE) Advisory (CVE-2026-7273)
[Affected Scope] Zyxel GS1900-48HPv2 firmware versions up to 2.90(ABTQ.1)C0.
Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
SonicWall SMA1000 Work Place Pre-Authentication Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-83548)
[Affected Scope] SonicWall SMA1000 Series Appliance Work Place interface
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.