CVE-2020-29583

What are Zyxel Firewalls and AP Controllers?

Zyxel produces enterprise and SMB network security appliances including ATP (Advanced Threat Protection) and USG (Unified Security Gateway) firewall series. These devices protect network perimeters, provide VPN access, and manage network traffic for businesses. The NXC2500 and NXC5500 are Zyxel's enterprise wireless access point controllers managing hundreds of APs. Because these devices control network security policy and VPN access, a compromised Zyxel firewall or AP controller gives an attacker full control over the network security boundary — they can disable firewall rules, intercept VPN traffic, modify routing, and provide persistent network access.

Overview

CVE-2020-29583 is a hardcoded credential vulnerability in Zyxel ATP/USG firewalls and NXC2500/NXC5500 AP controllers. An undocumented administrative account named zyfwp with an unchangeable password PrOw!aN_fXp is embedded in the firmware. The zyfwp account has admin-level privileges and is accessible via SSH and the HTTPS web administration interface. Any attacker with network access to the management interface can log in as zyfwp using the public password, gaining full administrative control. Dutch security firm Eye Control discovered the account in December 2020; once published, the credentials became publicly known, making exploitation trivial for anyone with access to the management interface.

Affected Versions

Technical Details

• Root cause: Hardcoded credentials (CWE-522) — the zyfwp account is compiled directly into the firmware with a fixed, unchangeable password that cannot be modified by administrators or removed through normal device management; the account exists across all devices running the affected firmware versions
• Unchangeable password: Unlike default passwords that can be changed, the zyfwp account's password is hardcoded and resistant to modification — patching is the only remediation; standard password policy enforcement cannot protect against this account
• Admin privileges: The zyfwp account has administrative access equivalent to the device's primary admin account — full control over firewall rules, VPN configuration, routing, wireless management (for AP controllers), and all device settings
• SSH and HTTPS access: The account is accessible via both SSH (port 22) and the HTTPS web management interface (port 443); SSH access is particularly dangerous as it provides an interactive shell for direct system manipulation
• Public credentials: Eye Control's disclosure simultaneously published the hardcoded password PrOw!aN_fXp; from the moment of disclosure, every attacker globally had the credentials — making patching urgency extreme for all internet-exposed Zyxel devices

Discovery

Discovered by Dutch security firm Eye Control in late 2020. Eye Control coordinated with Zyxel, which released patches simultaneously with the public disclosure on December 22, 2020. The simultaneous publication of the account name and password made the window between disclosure and patching a critical period for exploitation.

Exploitation Context

Hardcoded credential vulnerabilities in network security appliances are among the most easily exploited — no specialized knowledge or exploitation technique is required beyond knowing the credentials and having network access to the management interface. After Eye Control's disclosure published the zyfwp credentials, automated scanning tools immediately began probing internet-facing Zyxel devices for the known account. Nation-state actors and cybercriminal groups targeting Zyxel VPN appliances for network access exploited this in the weeks and months following disclosure. Shodan regularly indexed thousands of internet-exposed Zyxel management interfaces. The CISA KEV addition in November 2021 reflects persistent exploitation against unpatched devices.

Remediation

1. Apply Zyxel V4.60 Patch 1 or later for ATP/USG/FLEX/VPN series — removes the zyfwp hardcoded account
2. Apply Zyxel NXC2500/NXC5500 V6.10 Patch 1 or later for AP controllers
3. Immediately restrict management interface access: allow HTTPS (443) and SSH (22) only from authorized administrator IP addresses; block management port access from untrusted networks and the internet
4. Review authentication logs for unexpected zyfwp login attempts — exploitation may have already occurred on unpatched devices
5. After patching, rotate VPN shared secrets, admin passwords, and any credentials accessible via the management interface in case of prior compromise
6. For Zyxel VPN appliances: verify no unauthorized VPN accounts were created during any potential exploitation window