How to Reset a Forgotten Administrator Password on Zyxel USG FLEX H Series (Without Resetting Configuration)

This article explains how to reset the administrator password on Zyxel USG FLEX H Series devices without performing a factory reset. The recovery process requires connecting to the device via a serial cable and using the Tera Term terminal program.

Important Warnings and Precautions

• This procedure does not erase the device configuration (VPNs, rules, objects, and other settings remain intact).
• Back up your configuration whenever possible. Even though this method keeps the config, having a backup ensures you can restore everything in case of an unexpected issue.
• You must have physical access to the device and the proper console cable to perform this procedure.
• If you cannot enter Debug Mode or the commands are not accepted, verify the cable type and COM port settings.
• After regaining access, immediately change the password and configure restrictions for the admin interface to improve security.

Requirements

• Console cable RJ-45 → DB-9 (rollover) or a USB-to-Serial adapter (for PCs without a COM port).
• Tera Term program (or alternatives like PuTTY, SecureCRT).
• COM port settings: 115200, 8, N, 1, Flow Control = None.
• Physical access to the Zyxel device.

Step-by-Step Instructions

1. Connect to the Device

1. Plug the console cable into the device’s Console port and connect it to your PC.
2. Open Tera Term.
3. Select the appropriate COM port and configure it with these parameters:
   • Baud rate: 115200
   • Data bits: 8
   • Parity: None
   • Stop bits: 1
   • Flow control: None

2. Reboot and Enter Debug Mode

1. Reboot the device (via reboot button or power cycle).
2. During startup, Tera Term will display: “Press any key to enter debug mode.”
3. Press any key to access Debug Mode.

3. Reset the Password

Recommendation on Using the -f Parameter

It is strongly recommended not to use the -f option unless explicitly instructed by Zyxel Support or when working in a controlled lab environment.

• Without -f, the device may refuse to execute a command if there is a risk of service interruption or state loss.
• With -f, the command is executed regardless of warnings or restrictions, which can lead to unexpected behavior.

⚠️ Important: Using -f on a production device may result in a reboot or reset of the HA state, potentially impacting network availability.

At the Debug console, enter:

atkz -g
atgo -f

• atkz -g — resets the administrator password.
• atgo -f — exits Debug Mode and resumes normal boot-up.

4. Complete the Process

1. Wait for the device to finish booting.
2. Log in with username admin and the default password (commonly 1234, but verify with your model’s documentation or device label).
3. Immediately set a new strong password.