Use‑of‑Hard‑Coded Credentials in Zyxel Firewalls & AP Controllers (CVE‑2020‑29583)
What It Is – Zyxel ATP, USG, VM firewalls and NXC2500/NXC5500 AP controllers ship with an undocumented privileged account named zyfwp whose password is hard‑coded and cannot be changed.
Exploitability – The credential is publicly known; any actor with network reach can log in with full admin rights. No public exploit code is required, giving the flaw an effective CVSS 9.8 (Critical) rating.
Affected Products – Zyxel ATP firewalls, USG firewalls, VM firewalls, NXC2500 AP controller, NXC5500 AP controller.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for identity and access management controls that eliminate default or hard‑coded credentials and enforce strong authentication.
- Continuous monitoring of privileged‑account hygiene provides defensible evidence for auditors and regulators.
- A single unchecked credential can invalidate an organization’s claim of “secure configuration” across multiple compliance frameworks.
Recommended Actions
- Inventory all Zyxel devices and verify whether the
zyfwpaccount exists. - If present, disable or remove the account and rotate any associated passwords.
- Apply Zyxel’s latest firmware/patch that removes the hard‑coded credential.
- Update your credential inventory and capture remediation evidence for audit readiness.
Source: CISA KEV – CVE‑2020‑29583