CVE-2020-29583 Scanner
Targets the ZyXEL USG firmware version 4.60, where hard-coded credentials in the SSH service allow attackers to gain root access.
Used 3k times · 5.9k assets checked · domain, ipv4, subdomain
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVE
CVE-2020-29583
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
Updated Sep 22, 2026View on NVD →
S4E scanner
Monitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →