Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 90.2%; technical severity is CVSS 9.8.
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Who should care
- Teams operating Atp100 Firmware, Atp100w Firmware, Atp200 Firmware +28 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Atp100 Firmware, Atp100w Firmware, Atp200 Firmware +28 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Apply updates per vendor instructions.
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Vendor remediation
Patch and remediation links
Use the vendor source below to confirm the correct fixed version, package or mitigation for your affected product.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-522
- Affected versions
- Zyxel Atp100 Firmware (Version: 4.60); Zyxel Atp100w Firmware (Version: 4.60); Zyxel Atp200 Firmware (Version: 4.60); Zyxel Atp500 Firmware (Version: 4.60); Zyxel Atp700 Firmware (Version: 4.60); Zyxel Atp800 Firmware (Version: 4.60); Zyxel Multiple Products; Zyxel Usg Flex 100 Firmware (Version: 4.60)
- Published
- 22 December 2020
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 90.2%
- Signal calculated at 84