HighPublic exploit

Hardcoded super-user password in ZyXEL PK5001Z

IdentifiersCVE-2016-10401CWE-798

CVE-2016-10401 is a hardcoded credential vulnerability in ZyXEL PK5001Z devices. The affected firmware includes a hidden super-user password that can be used with the local su mechanism to elevate an existing non-root session to root. Public reporting also associates the issue with PK5001Z firmware version 2.6.20.19 and shows exploitation over Telnet after logging in with a lower-privileged account. The core flaw is the presence of an embedded, undocumented privileged password in the device software, which bypasses normal administrative credential management and enables straightforward privilege escalation to full system control.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker who has obtained access to a non-root account on the device to escalate privileges to root. Root access on the modem enables complete compromise of the device, including unrestricted administrative control, modification of configuration, execution of arbitrary commands, installation of malware or botnet payloads, theft of user or device information, and use of the device for further malicious activity such as propagation or network abuse.

Mitigation

If you can’t patch tonight, do this now.

Restrict management-plane exposure, especially Telnet, to trusted internal networks or disable it entirely where possible. Enforce strong unique credentials for all accessible accounts to prevent attackers from first obtaining a non-root session. Use network segmentation and access controls to prevent untrusted remote access to the device management interface. Monitor for unauthorized administrative logins, privilege escalation attempts, and anomalous command execution on affected devices. Where firmware remediation is unavailable, replacing the device is the most reliable mitigation.

Remediation

Patch, then assume compromise.

Upgrade affected ZyXEL PK5001Z devices to vendor-provided firmware that removes the hardcoded privileged password, if such an update is available from the vendor or ISP managing the deployment. Replace devices that cannot be updated or are end-of-life. Review ISP-customized deployments for inherited default or undocumented credentials, and ensure administrative and user account passwords are changed from any defaults. After remediation, verify that privileged escalation via the hidden su password is no longer possible and inspect devices for signs of prior compromise.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Zyxel CommunicationsPk5001z Firmwareoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

mdpiNews

May 2, 2026

Evolving IoT Botnet Threats and Practical Honeypot Observation: A Summary Review and Experimental Study

An IoT vulnerability cited as an example of weak default credentials used to emulate common botnet-targeted device weaknesses in the honeypot study.

netlab 360News

Jul 6, 2018

HNS Botnet Recent Activities

A vulnerability previously reported as used by the HNS IoT botnet for propagation and malicious code deployment.

fortinet threat researchNews

Apr 16, 2018

Searching for the Reuse of Mirai Code: Hide ‘N Seek Bot

A vulnerability/backdoor in ZyXEL PK5001Z modems that allows privilege escalation to root after telnet access, used by the HNS malware sample discussed in the article.

bleeping computerNews

Nov 24, 2017

Mirai Activity Picks up Once More After Publication of PoC Exploit Code

A vulnerability in ZyXEL PK5001Z routers involving a hidden hardcoded su password that can be used, in combination with valid/default Telnet credentials, to gain root privileges.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware5

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity