CVE-2020-29583

CWE-522

Critical

103.7

RPS

Description

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

Source: NVD

CVSS: 9.8; Critical · v3.1
EPSS: 90.15%; Probability of exploitation in the next 30 days (FIRST)
CISA KEV: In CISA KEV since Nov 2021
Fix commit: No known fix commit; Sources: MoreFixes, FreshFixes
Weakness: CWE-522
Published: 22 Dec 2020; Last modified 7 Nov 2025

How to read these signals: RPS · EPSS · CISA KEV · Data sources

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2020-29583

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 7 Oct 2026, 05:16 UK time

CVE-2020-29583

Description

Signals

Get this score from the API