How severe is CVE-2020-29583?

CVE-2020-29583 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2020-29583 being actively exploited?

Yes. CVE-2020-29583 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2021-11-03, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2020-29583?

CVE-2020-29583 primarily affects Zyxel Usg20-vpn Firmware. In total, 30 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-29583?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2020-29583 have an EU (EUVD) identifier?

Yes. CVE-2020-29583 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-21944. It is also flagged as exploited in the EUVD (since 2021-11-03).

When was CVE-2020-29583 published?

CVE-2020-29583 was published on 2020-12-22 and last updated on 2026-06-17.

CVE-2020-29583

CVE-2020-29583 is a critical-severity vulnerability in Zyxel Usg20-vpn Firmware with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2021-11-03). The underlying weakness is classified as CWE-522.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 10.0
EPSS exploit prediction: 90% (100th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2021-11-03)
EU (EUVD) id: EUVD-2020-21944
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2021-11-03)
Weakness: CWE-522
Affected product: Zyxel Usg20-vpn Firmware
Published: 2020-12-22
Last modified: 2026-06-17

Description

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

Frequently asked questions

What is CVE-2020-29583?: Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
How severe is CVE-2020-29583?: CVE-2020-29583 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-29583 being actively exploited?: Yes. CVE-2020-29583 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2021-11-03, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2020-29583?: CVE-2020-29583 primarily affects Zyxel Usg20-vpn Firmware. In total, 30 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-29583?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2020-29583 have an EU (EUVD) identifier?: Yes. CVE-2020-29583 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-21944. It is also flagged as exploited in the EUVD (since 2021-11-03).
When was CVE-2020-29583 published?: CVE-2020-29583 was published on 2020-12-22 and last updated on 2026-06-17.

References

Affected products (30)

cpe:2.3:o:zyxel:usg20-vpn_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg20w-vpn_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg40_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg40w_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg60_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg60w_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg110_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg210_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg310_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg1100_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg1900_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg2200_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:zywall110_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:zywall310_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:zywall1100_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp100_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp100w_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp200_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp500_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp700_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp800_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vpn50_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vpn100_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vpn300_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vpn1000_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100w_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_500_firmware:4.60:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_700_firmware:4.60:*:*:*:*:*:*:*

More vulnerabilities in Zyxel Usg20-vpn Firmware

CVE-2023-33010 — Critical (CVSS 9.8): A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36…
CVE-2023-33009 — Critical (CVSS 9.8): A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36…
CVE-2021-35029 — Critical (CVSS 9.8): An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware…
CVE-2020-9054 — Critical (CVSS 9.8): Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication…
CVE-2023-27991 — High (CVSS 8.8): The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32…
CVE-2023-6764 — High (CVSS 8.1): A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32…

All CVEs affecting Zyxel Usg20-vpn Firmware →

Other CWE-522 (Insufficiently Protected Credentials) vulnerabilities

CVE-2026-7312 — Critical (CVSS 10.0): CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to…
CVE-2026-29128 — Critical (CVSS 10.0): IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g.,…
CVE-2025-54863 — Critical (CVSS 10.0): Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration…
CVE-2024-12799 — Critical (CVSS 10.0): Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64…
CVE-2024-51545 — Critical (CVSS 10.0): Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list…
CVE-2023-1778 — Critical (CVSS 10.0): This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to…

Browse all CWE-522 (Insufficiently Protected Credentials) vulnerabilities →