CVE-2020-29583: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

CVE-2020-29583 is a hard-coded credentials flaw affecting certain Zyxel firewalls (ATP, USG, VM series) and AP controllers (NXC2500 and NXC5500). An undocumented account named "zyfwp" ships with a fixed, unchangeable password, giving anyone who knows or discovers those credentials a ready path into the device. For IT and security teams this matters because these products often sit at network perimeters or manage wireless infrastructure; unauthorized access can lead to configuration changes, traffic interception, or lateral movement. Confirm exact product coverage and fixed releases against the vendor advisory.

How it works

The weakness is classified as CWE-522 (insufficiently protected credentials). The devices contain a built-in administrative account that is not documented for normal use and whose password cannot be altered by the operator. An attacker who obtains the credential—through public disclosure, reverse engineering, or prior compromise—can authenticate directly to the management interface or other services that accept that account. Because the password is static and shared across affected units, successful authentication does not require brute-forcing or credential stuffing against unique user accounts. Once inside, the attacker inherits the privileges associated with that account, which on network security appliances typically include the ability to alter rules, view logs, or pivot further into the environment. No additional exploit code is required beyond valid login; the vulnerability is the credential itself.

Am I affected? How to find it in your systems

These Zyxel firewalls and AP controllers commonly appear at Internet edges, in branch offices, or as wireless LAN controllers. Inventory steps:

• Query asset-management or network-discovery tools for Zyxel ATP, USG, VM firewall models and NXC2500/NXC5500 controllers.
• Log into each device’s management interface or use the vendor’s CLI/API to list local accounts; the presence of an account named “zyfwp” is a strong indicator.
• Compare running firmware versions with the fixed releases listed in the Zyxel advisory; any version prior to the patched release should be treated as vulnerable until confirmed otherwise.
• Review authentication logs for successful or attempted logins under the “zyfwp” username, especially from unexpected source addresses.
• Check configuration backups and hardening baselines for any reference to the undocumented account.

If your environment uses centralized SIEM or firewall logging, create a simple detection rule for that username. Absence of the account name in logs does not prove the device is clean—only that the account has not yet been used.

How to remediate

The primary remediation is to apply the vendor-supplied updates exactly as described in the Zyxel security advisory for CVE-2020-29583. CISA’s required action is the same: follow the vendor’s instructions. After patching:

• Verify that the “zyfwp” account is no longer present or is rendered unusable.
• Change all other administrative credentials and disable any unused accounts.
• Restrict management-plane access to dedicated jump hosts or out-of-band networks.
• Enable multi-factor authentication where the platform supports it.
• Re-validate firewall rules and controller configurations for unauthorized changes that may have occurred before the patch.

Document the firmware versions now running and schedule periodic checks against future Zyxel advisories.

If you can't patch immediately

When immediate firmware updates are operationally impossible, apply compensating controls to reduce exposure:

• Segment the management interfaces onto an isolated VLAN or management VRF reachable only from trusted administrator workstations.
• Block inbound access to the device’s administrative ports (commonly HTTPS, SSH, or proprietary management ports) at upstream firewalls or ACLs, allowing only known-good source addresses.
• If a web application firewall or reverse proxy sits in front of the management UI, consider a temporary virtual patch that denies requests containing the “zyfwp” username.
• Disable remote management entirely if local console or out-of-band access is sufficient for interim operations.
• Increase monitoring: alert on any authentication attempt using “zyfwp”, on configuration commits, and on new administrative sessions.
• Export and retain current configuration and log files so that forensic comparison is possible later.

These measures do not remove the hard-coded credential; they only shrink the attack surface until the official update can be installed.

If your data may have been exposed

Actively exploited vulnerabilities on perimeter devices can lead to broader network compromise and data exposure. If you have evidence of successful “zyfwp” logins or unexplained configuration changes, treat the incident as a potential breach: isolate affected systems, preserve logs, and begin incident-response procedures. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether related credentials have already appeared in public dumps.