CVE-2020-29583
CRITICAL KEV NUCLEIZyxel USG <4.60 - Privilege Escalation
Title source: llmExploitation Summary
CVE-2020-29583 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 1 public exploit from researchers including ruppde. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a Python-based scanner for detecting Zyxel devices vulnerable to CVE-2020-29583, which involves an undocumented user account. The scanner checks for specific firmware version strings in the device's web interface to identify potentially vulnerable devices but does not attempt to exploit the vulnerability.
Description
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
Exploits (1)
This repository contains a Python-based scanner for detecting Zyxel devices vulnerable to CVE-2020-29583, which involves an undocumented user account. The scanner checks for specific firmware version strings in the device's web interface to identify potentially vulnerable devices but does not attempt to exploit the vulnerability.
Nuclei Templates (1)
title:"USG FLEX 100" || http.title:"usg flex 100"
title="usg flex 100"
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H