Zyxel does not accept the default password after reset — what’s the reason and how to regain access?

If you've reset the settings on your Zyxel access point, router, switch, or firewall, but the default password (such as admin / 1234 or the one printed on the device sticker) doesn’t work — most likely the device is linked to Zyxel's cloud system, Nebula. This is normal behavior, but if you're unaware of how Nebula works, it may seem confusing or even problematic.

In this article, you’ll learn why the default password doesn't work after a reset, and what you need to do to regain access to the device.

Why doesn't the default password work after a reset?

If the device was previously registered in the Nebula Control Center, then after connecting to the internet it will:

• Automatically connect to the cloud,

• Retrieve the current configuration,

• Replace the default password with the one set in Nebula.

Even a full factory reset won’t help if the device remains online.

This applies to all devices that support Nebula cloud management:

• Access Points (e.g., NWA, WAX series)

• Switches (GS, XGS, XS)

• Routers (including LTE and 5G models)

• Firewalls (USG FLEX, ATP, etc.)

Exception:
The USG FLEX H Series Firewall does not overwrite the local password, even when connected to Nebula. It always allows login using the manually set password.

Quick solution — what to do if the default password doesn't work?

Here are three ways to regain access:

1. Log in with the Nebula password

If the device is still managed via the cloud:

1. Go to the Nebula Control Center.

2. Open the appropriate organization and site.

3. Navigate to:
   Site-wide → General Settings → Device Configuration → Device Password.

4. Use the password shown there to log in to the web interface.

2. Temporarily disconnect the device from the internet

If you want to use the default password:

1. Perform a hardware reset.

2. Do not connect the device to the internet (e.g., unplug the WAN cable).

3. Connect to the device directly via LAN.

4. Log in using the default credentials (admin / 1234).

5. Apply the necessary configuration.

As soon as the device regains internet access, it will reconnect to Nebula and overwrite the local password again.

3. Completely remove the device from the Nebula organization

If you want to permanently disable cloud management:

1. Go to the Nebula Control Center.

2. Navigate to:
   Organization-wide → License & Inventory → Devices.

3. Locate the required device.

4. Click “Remove” and be sure to select removal from the entire organization, not just the site!

5. Then perform a factory reset.

Now the device will use the default password and will not sync with the cloud, even if it has internet access.