Paper/Archive/CVE-2020-29583

CVE-2020-29583

Zyxel Multiple Products — Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

KEV · due 3 May EPSS 90%public exploit SSVC act CVSS 9.8

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 99.8.998 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refzyxel.com/support/security_advisories.shtml refftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf refbusinessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15 refbusinessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release refeyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html refzyxel.com/support/CVE-2020-29583.shtml refsecpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583 kevcisa.gov/known-exploited-vulnerabilities-catalog