CVE-2020-29583: Zyxel USG and ATP firmware hard-coded admin credential

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityA network-reachable, unauthenticated hard-coded admin credential with CVSS 9.8, KEV listing, and near-maximum EPSS makes full device compromise likely and high impact.

What it is

Zyxel USG and ATP firmware version 4.60 ships an undocumented account (zyfwp) whose password is stored in cleartext in the firmware and cannot be changed. Anyone who extracts the password can log in to the SSH server or web interface with full administrative privileges. Because the credential is fixed and shared across affected devices, it is a persistent, network-reachable backdoor into the firewall or gateway.

Impact

An attacker gains admin-level access to the device, allowing configuration changes, traffic interception or redirection, and use of the appliance as a foothold into the protected network.

Attack surface

The flaw is reachable over the network through the SSH service or web management interface; no authentication is required beforehand and no user interaction is needed, as reflected by the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

CVE-2020-29583 is listed in CISA KEV with a 2022-05-03 remediation due date, and EPSS gives a 30-day exploitation probability of about 0.90 (99.8th percentile); a reference is tagged Exploit.

What to do

• Upgrade affected Zyxel USG, ZyWALL, and ATP devices to a firmware release that removes the zyfwp account, per the vendor advisory.
• If immediate upgrade is not possible, block SSH and web management access to the devices from untrusted networks and restrict them to a dedicated management segment.
• Audit device configurations and logs for any use of the zyfwp account and remove or disable it where the firmware permits.
• Rotate any credentials or secrets that may have been exposed through administrative access to the device.
• Monitor vendor advisories for updated firmware, since the credential is embedded and cannot be changed by configuration alone.

Detection

• Search authentication logs on Zyxel devices and upstream systems for logins using the account name zyfwp.
• Alert on successful SSH or HTTPS management logins to these devices from unexpected source IPs or outside management windows.
• Review firewall and netflow logs for management-port connections to Zyxel appliances from external or non-management networks.
• Inventory Zyxel USG, ZyWALL, and ATP devices and verify firmware version to identify units still running 4.60.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.