CVE-2020-29583

Name of the Vulnerable Software and Affected Versions: Zyxel USG devices version 4.60

Description: The issue concerns an undocumented account zyfwp with an unchangeable password that can be found in cleartext in the firmware of Zyxel USG devices. This account allows someone to login to the ssh server or web interface with admin privileges. The password for this account is PrOw!aN fXp. There is a significant increase in attempts to access this known SSH backdoor using these undocumented credentials.

Recommendations: For Zyxel USG devices version 4.60, consider disabling the zyfwp account until a patch is available. Restrict access to the ssh server and web interface to minimize the risk of exploitation. Avoid using the zyfwp account and its associated password PrOw!aN fXp until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.