CVE-2020-29583

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.902 · 100 %ileexploit · PoCEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 1 exploit · PoC

Likely / severe?

90.2% (100th) EPSS

CVSS 10 · high

Is it mine?

61 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

added 2021-11-03remediate by 2022-05-03

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-26

Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9.8–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 10 · impact 10

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-522USprimaryCWE-312US

exploits (1)

Public proof-of-concept and weaponised exploit code.

ruppde/scan_CVE-2020-29583Scanner for Zyxel products which are potentially vulnerable due to an undocumented user account (CVE-2020-29583)PoC · poc_in_github

affected products (61)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
Zyxel Communications Corp. ATP100≤ 4.60fstec_bduRU
Zyxel Communications Corp. ATP100W≤ 4.60fstec_bduRU
Zyxel Communications Corp. ATP200≤ 4.60fstec_bduRU
Zyxel Communications Corp. ATP500≤ 4.60fstec_bduRU
Zyxel Communications Corp. ATP700≤ 4.60fstec_bduRU
Zyxel Communications Corp. ATP800≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG FLEX 100≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG FLEX 100W≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG FLEX 200≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG FLEX 500≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG FLEX 700≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG110≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG1100≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG1900≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG20-VPN≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG20W-VPN≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG210≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG2200≤ 4.60fstec_bduRU
Zyxel Communications Corp. USG310≤ 4.60fstec_bduRU

showing 20 of 61

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

published 2020-12-22modified 2026-06-17

related (1,720)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2021-40655US	high7.5OT critical	86.7% (100th)	KEV	2021-09-24
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php…
CVE-2021-30116US	critical9.8OT critical	85.7% (100th)	KEV	2021-07-09
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the insta…
CVE-2021-22681US	critical9.8OT critical	63.6% (99th)	KEV	2021-03-03
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell…
CVE-2017-9248US	critical9.8OT critical	75.1% (100th)	KEV	2017-07-03
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionK…
CVE-2014-1812US	high9.0OT critical	65.1% (99th)	KEV	2014-05-14
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does…

+1715 more

references (23)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan