Use of hard-coded credentials in ZyXEL Communications Corp. products - CVE-2020-29583
Published: December 22, 2020 / Updated: November 29, 2021
Vulnerability identifier: #VU49149
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-29583
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to gain full access to vulnerable system.
The vulnerability exists due to presence of hard-coded account zyfwp with an unchangeable password. A remote unauthenticated attacker can access the affected system via ssh or web interface using the hard-coded credentials and gain administrative privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
NXC2500
NXC5500
ZyXEL ZLD
NXC5500
ZyXEL ZLD
How to mitigate CVE-2020-29583
Install updates from vendor's website.
NXC2500 - update to 6.10 Patch1
NXC5500 - update to 6.10 Patch1
ZyXEL ZLD - update to 4.60 Patch1
NXC5500 - update to 6.10 Patch1
ZyXEL ZLD - update to 4.60 Patch1
Links to Public Exploits and PoC-codes
- Exploit #7099 - scan_CVE-2020-29583 (Scanner for Zyxel products which are potentially vulnerable due to an undocumented user account (CVE-2020-29583)) (November 29, 2021)
- Exploit #4993 - scan_CVE-2020-29583 (Scanner for Zyxel products which are potentially vulnerable due to an undocumented user account (CVE-2020-29583)) (January 5, 2021)
External References
- http://ftp.zyxel.com/USG40/firmware/USG40_4.60(AALA.1)C0_2.pdf
- https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release
- https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15
- https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html
- https://www.zyxel.com/support/CVE-2020-29583.shtml
- https://www.zyxel.com/support/security_advisories.shtml