Critical · published December 22, 2020
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 A hardcoded admin account hidden in the firmware? That's like leaving the front door wide open with a neon sign pointing to it! 🔥 Think of it like a hotel room with a master key that nobody thought to change — it’s just sitting there, waiting for someone to walk in, no questions asked! This undocumented account, 'zyfwp', is the ultimate welcome mat for intruders. An attacker could easily waltz in with admin privileges, gaining full control over your Zyxel USG device. This could lead to unauthorized access to sensitive data, network manipulation, or even an intrusion into other connected systems. It’s not just a breach; it’s an absolute nightmare!
Think of it like a hotel room with a master key that nobody thought to change — it’s just sitting there, waiting for someone to walk in, no questions asked! This undocumented account, 'zyfwp', is the ultimate welcome mat for intruders. Firmware version 4.60 of Zyxel USG devices contains an undocumented account with a fixed password stored in cleartext, allowing attackers to log into the SSH server or web interface with full admin rights.
An attacker could easily waltz in with admin privileges, gaining full control over your Zyxel USG device. This could lead to unauthorized access to sensitive data, network manipulation, or even an intrusion into other connected systems. It’s not just a breach; it’s an absolute nightmare! Patch your devices immediately to the latest firmware version to eliminate this vulnerability. Review your network configurations, and consider implementing additional security layers like firewalls to protect against unauthorized access. Don't forget to change default passwords on all devices! You've got this! By taking these steps, you're sealing the door and keeping the bad guys out! 🛡️