The vulnerability of microprogrammed network devices such as ZyXEL USG, USG VPN, ATP, ZyWALL, and FLEX lies in the unencrypted storage of data, which allows attackers to gain unauthorized access to protected information.

🗓️ 30 Mar 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Unencrypted data storage on microprogrammed Zyxel devices using the zyfwp account enables remote unauthorized access.

Reporter	Title	Published	Views	Family All 25
GithubExploit	Exploit for Insufficiently Protected Credentials in Zyxel Usg20-Vpn_Firmware	4 Jan 202100:56	–	githubexploit
ICS	People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices	10 Jun 202212:00	–	ics
ATTACKERKB	CVE-2020-29583 Zyxel USG Hard-Coded Admin Creds	22 Dec 202000:00	–	attackerkb
Circl	CVE-2020-29583	23 Dec 202000:53	–	circl
CISA KEV Catalog	Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability	3 Nov 202100:00	–	cisa_kev
CISA	MS-ISAC Releases Cybersecurity Advisory on Zyxel Firewalls and AP Controllers	8 Jan 202100:00	–	cisa
CNNVD	Zyxel USG Series Encryption Issues Vulnerabilities	22 Dec 202000:00	–	cnnvd
CVE	CVE-2020-29583	22 Dec 202000:00	–	cve
Cvelist	CVE-2020-29583	22 Dec 202000:00	–	cvelist
NCSC	Serious vulnerability fixed in Zyxel products	23 Dec 202000:00	–	ncsc

Vulners

Node

zyxel_communications usg2200Match4.60

OR

zyxel_communications usg110Match4.60

OR

zyxel_communications usg210Match4.60

OR

zyxel_communications usg1100Match4.60

OR

zyxel_communications usg1900Match4.60

OR

zyxel_communications usg20w-vpnMatch4.60

OR

zyxel_communications usg310Match4.60

OR

zyxel_communications usg20-vpnMatch4.60

OR

zyxel_communications usg40Match4.60

OR

zyxel_communications usg40wMatch4.60

OR

zyxel_communications usg60Match4.60

OR

zyxel_communications usg60wMatch4.60

OR

zyxel_communications atp100Match4.60

OR

zyxel_communications atp200Match4.60

OR

zyxel_communications atp500Match4.60

OR

zyxel_communications atp800Match4.60

OR

zyxel_communications atp700Match4.60

OR

zyxel_communications atp100wMatch4.60

OR

zyxel_communications zywall_110Match4.60

OR

zyxel_communications zywall_1100Match4.60

OR

zyxel_communications zywall_310Match4.60

OR

zyxel_communications vpn50Match4.60

OR

zyxel_communications vpn300Match4.60

OR

zyxel_communications vpn100Match4.60

OR

zyxel_communications vpn000Match4.60

OR

zyxel_communications usg_flex_100Match4.60

OR

zyxel_communications usg_flex_100wMatch4.60

OR

zyxel_communications usg_flex_200Match4.60

OR

zyxel_communications usg_flex_500Match4.60

OR

zyxel_communications usg_flex_700Match4.60

Source	Link
ftp	www.ftp.zyxel.com/USG40/firmware/USG40_4.60(AALA.1)C0_2.pdf
businessforum	www.businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release
businessforum	www.businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15
zyxel	www.zyxel.com/support/CVE-2020-29583.shtml
zyxel	www.zyxel.com/support/security_advisories.shtml
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-29583
cxsecurity	www.cxsecurity.com/cveshow/CVE-2020-29583/
secpod	www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 39.8

CVSS 210

EPSS0.90049

unencrypted storage microprogrammed devices zyfwp account remote access zyxel devices