CVE-2020-29583: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

CVE-2020-29583 identifies a use of hard-coded credentials vulnerability affecting multiple Zyxel products, including firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500). The vulnerability stems from an undocumented account "zyfwp" that has a hard-coded password which cannot be altered. This security flaw can be exploited to gain unauthorized access to affected devices. The vulnerability has been exploited in the wild, indicating active threat actor usage.

The presence of hard-coded, unchangeable credentials in Zyxel devices allows attackers to bypass authentication controls, potentially leading to unauthorized access and control over the affected devices. This can compromise network security, confidentiality, and availability of services managed by these devices.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider compensating controls such as network segmentation, restricting management interface access, and monitoring for unauthorized access attempts.