CVE-2020-29583: Zyxel USG20-VPN Auth Bypass Vulnerability

CVE-2020-29583 Overview

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the SSH server or web interface with admin privileges, effectively providing complete administrative control over affected network security appliances.

Critical Impact

This vulnerability allows unauthenticated remote attackers to gain full administrative access to Zyxel firewalls, VPN gateways, and access point controllers using hardcoded credentials. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog due to active exploitation in the wild.

Affected Products

• Zyxel USG Series (USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200) running firmware 4.60
• Zyxel ZyWALL Series (ZyWALL110, ZyWALL310, ZyWALL1100) running firmware 4.60
• Zyxel ATP Series (ATP100, ATP100W, ATP200, ATP500, ATP700, ATP800) running firmware 4.60
• Zyxel VPN Series (VPN50, VPN100, VPN300, VPN1000) running firmware 4.60
• Zyxel USG FLEX Series (USG FLEX 100, USG FLEX 100W, USG FLEX 200, USG FLEX 500, USG FLEX 700) running firmware 4.60

Discovery Timeline

• December 22, 2020 - CVE-2020-29583 published to NVD
• November 7, 2025 - Last updated in NVD database

Technical Details for CVE-2020-29583

Vulnerability Analysis

This vulnerability represents a severe hardcoded credentials issue (CWE-522: Insufficiently Protected Credentials) affecting Zyxel's enterprise-grade network security appliances. The undocumented zyfwp account was embedded in firmware version 4.60 with its password stored in cleartext within the firmware image itself. Since network firewalls and VPN gateways typically sit at the network perimeter with SSH (port 22) and web management interfaces (ports 80/443) exposed, this vulnerability creates a trivially exploitable entry point for attackers.

The scope of impact is significant given that these devices are designed to protect enterprise networks. Successful exploitation grants attackers the same level of access as legitimate administrators, enabling complete network compromise including traffic interception, firewall rule manipulation, VPN configuration access, and potential lateral movement into protected networks.

Root Cause

The root cause of this vulnerability is the inclusion of an undocumented administrative account with hardcoded credentials in the device firmware. The zyfwp account appears to have been created for internal purposes—potentially firmware update mechanisms or factory provisioning—but was inadvertently left accessible in production firmware releases. The credentials were not properly protected and could be extracted directly from the firmware image, making the password publicly discoverable. Since the password cannot be changed by device administrators, affected devices remain vulnerable until firmware is updated.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. Attackers can exploit this vulnerability by:

1. Identifying exposed Zyxel devices through network scanning (ports 22 for SSH or 443 for web management)
2. Extracting or obtaining the hardcoded zyfwp credentials from publicly available firmware images or security research
3. Authenticating to the SSH service or web management interface using the undocumented account
4. Gaining full administrative privileges on the device

The attack can be executed remotely against any internet-exposed Zyxel device running vulnerable firmware. Once authenticated, attackers have complete control over firewall rules, VPN configurations, routing tables, and other security-critical settings.

Detection Methods for CVE-2020-29583

Indicators of Compromise

• Successful SSH or web interface login events for the username zyfwp in device authentication logs
• Unexpected administrative sessions originating from external or unknown IP addresses
• Configuration changes to firewall rules, VPN settings, or user accounts not attributable to legitimate administrators
• New user accounts created or existing account privileges modified without authorization

Detection Strategies

• Monitor authentication logs for login attempts using the zyfwp username
• Implement network monitoring to detect SSH (port 22) and HTTPS (port 443) connections to Zyxel management interfaces from untrusted sources
• Deploy intrusion detection rules to alert on authentication attempts using known hardcoded credential patterns
• Perform regular firmware version audits to identify devices running vulnerable firmware 4.60

Monitoring Recommendations

• Enable detailed logging on all Zyxel appliances and forward logs to a centralized SIEM
• Configure alerts for any successful authentication events involving the zyfwp account
• Monitor for configuration changes on affected devices, particularly firewall rule modifications and new account creation
• Implement network segmentation monitoring to detect lateral movement from compromised perimeter devices

How to Mitigate CVE-2020-29583

Immediate Actions Required

• Immediately upgrade all affected Zyxel devices to firmware version 4.60 Patch 1 or later, which removes the hardcoded credentials
• Restrict SSH and web management interface access to trusted internal networks only—do not expose management interfaces to the internet
• Review device authentication logs for any historical access using the zyfwp account to determine if compromise may have occurred
• Conduct a full configuration audit of affected devices to identify unauthorized changes

Patch Information

Zyxel has released firmware version 4.60 Patch 1 which addresses this vulnerability by removing the undocumented zyfwp account. Organizations should obtain the updated firmware from the Zyxel CVE-2020-29583 Support Page and apply it immediately to all affected devices. The Zyxel ZLD4.60 Patch 1 Announcement provides additional details about the patch release.

Workarounds

• If immediate patching is not possible, disable SSH access to the device and restrict web management interface access to trusted IP addresses only using firewall rules
• Implement network access control lists (ACLs) on upstream network devices to limit who can reach Zyxel management interfaces
• Deploy a VPN or jump host architecture to ensure management access only occurs through authenticated, authorized channels
• Enable multi-factor authentication if supported by your Zyxel device model for an additional layer of protection

# Example: Restrict management interface access via network ACL
# Apply on upstream router/firewall to limit access to Zyxel management
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -d <zyxel_mgmt_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -d <zyxel_mgmt_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -d <zyxel_mgmt_ip> -j DROP
iptables -A INPUT -p tcp --dport 443 -d <zyxel_mgmt_ip> -j DROP