{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2020-29583", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2023-10-28T00:43:07.540036", "dateReserved": "2020-12-06T00:00:00", "datePublished": "2020-12-22T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-10-28T00:43:07.540036"}, "descriptions": [{"lang": "en", "value": "Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.zyxel.com/support/security_advisories.shtml"}, {"url": "http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf"}, {"url": "https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15"}, {"url": "https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release"}, {"url": "https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html"}, {"url": "https://www.zyxel.com/support/CVE-2020-29583.shtml"}, {"url": "https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}}}

{"cisaActionDue": "2022-05-03", "cisaExploitAdd": "2021-11-03", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg20-vpn_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "660A9038-66FB-4F71-BA50-8ED69C2E2274", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*", "matchCriteriaId": "7239C54F-EC9E-44B4-AE33-1D36E5448219", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg20w-vpn_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "E892C61D-80DE-4FA4-9224-1B3C72A31F57", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*", "matchCriteriaId": "06D2AD3A-9197-487D-A267-24DE332CC66B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg40_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "29398F33-D8B4-432D-A075-4454DA1B23F0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*", "matchCriteriaId": "5CCD2777-CC85-4BAA-B16B-19C2DB8DB742", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg40w_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "BA146A61-7B27-4E48-87C1-A82F45FB692A", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*", "matchCriteriaId": "0906F3FA-793B-421D-B957-7E9C18C1AEC0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg60_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "14F685CA-FBD9-4A00-BB23-BF914DFE41D9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*", "matchCriteriaId": "26900300-1325-4C8A-BC3B-A10233B2462A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg60w_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "022CF987-20A8-4450-A8B8-94AF2F2D453E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*", "matchCriteriaId": "A5A7555E-BC29-460C-A701-7DCDEAFE67F3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg110_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "7540894B-A1EF-40C3-ABD3-D58CDB45622F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*", "matchCriteriaId": "4834AC5E-884D-4A1C-A39B-B3F4A281E3CB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg210_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "6556E988-676D-4E7A-BDC2-A53256548FEA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*", "matchCriteriaId": "EAFF1122-755A-4531-AA2E-FD6E8478F92F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg310_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "56EF63D0-63DD-4EFD-AE7A-5680710AE573", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*", "matchCriteriaId": "F302801D-3720-4598-8458-A8938BD6CB46", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg1100_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "8451A4C8-2023-41A4-81A9-91565CEC6918", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*", "matchCriteriaId": "4B68C4BD-3279-47AB-AC2A-7555163B12E2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg1900_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "7391C72E-CAB3-4FAD-9FB6-789F48516C26", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*", "matchCriteriaId": "60F4E816-C4D3-451A-965C-45387D7DEB5B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg2200_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "B3B7B49D-7DB2-4D44-AC55-6B1F828B512D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg2200:-:*:*:*:*:*:*:*", "matchCriteriaId": "231547C3-33B8-42B7-983E-AA3C6CA5D107", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:zywall110_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "52922CA2-1C1E-4972-A52E-D9FA84BCC4C1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:zywall110:-:*:*:*:*:*:*:*", "matchCriteriaId": "2347F91E-8AA3-4EB5-AD7F-7602A46C20BD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:zywall310_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "C9336382-E759-4869-9B59-57366E176CA2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:zywall310:-:*:*:*:*:*:*:*", "matchCriteriaId": "3A97613C-26EF-481E-9215-197FE7A9D1C6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:zywall1100_firmware:4.60:*:*:*:*:*:*:*", "matchCriteriaId": "271DE232-FAED-48A1-891C-33A6FDBA9EAA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:zywall1100:-:*:*:*:*:*:*:*", "matchCriteriaId": "53A5732E-193B-4017-A434-A76BE80E20D9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges."}, {"lang": "es", "value": "La versi\u00f3n de firmware 4.60 de los dispositivos Zyxel USG contiene una cuenta no documentada (zyfwp) con una contrase\u00f1a que no puede ser cambiada. La contrase\u00f1a para esta cuenta se puede encontrar en texto sin cifrar en el firmware. Esta cuenta puede ser usada por alguien para iniciar sesi\u00f3n en el servidor ssh o en la interfaz web con privilegios de administrador"}], "id": "CVE-2020-29583", "lastModified": "2023-11-07T03:21:32.250", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-12-22T22:15:14.443", "references": [{"source": "cve@mitre.org", "url": "http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html"}, {"source": "cve@mitre.org", "url": "https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.zyxel.com/support/CVE-2020-29583.shtml"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.zyxel.com/support/security_advisories.shtml"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}