Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
• EPSS: 90% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

CISA: Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdfBroken Link
• businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-releaseRelease Notes
• businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15Release Notes
• www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.htmlBroken LinkThird Party Advisory
• www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administ…ExploitThird Party Advisory
• www.zyxel.com/support/CVE-2020-29583.shtmlVendor Advisory
• www.zyxel.com/support/security_advisories.shtmlVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource