CWE-257: Storing Passwords in a Recoverable Format
The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
A kind of CWE-522 Insufficiently Protected Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- red lion controls 700 series Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format 9.3 Critical
- itron mv-90 xi Improperly Stored Credentials 5.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 more Windows DHCP Server Information Disclosure Vulnerability 6.5 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 4.7 Medium
- andritz 250 scala, hipase-250 +1 more Storage of passwords in a reversible format 7.5 High
- redmine Stored credentials in Redmine 5.3 Medium
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 more A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0... 4.1 Medium
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 more A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0... 4.1 Medium
- progress software corporation openedge Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge 9.1 Critical
- belden hirschmann hilcos classic platform Hirschmann HiLCOS Classic Platform Password Exposure via SNMP 8.6 High
- eaton easysoft The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to... 6.1 Medium
- rustdesk, rustdesk-client rustdesk client +1 more RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305) 8.2 High
- cisco catalyst sd-wan manager Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability 7.5 High
- explorance blue Use of a hardcoded static key to protect sensitive data in Explorance Blue 6.8 Medium
- automated logic webctrl, carrier i-vu +1 more Automated Logic WebCTRL and Carrier i-Vu Session Fixation 7.0 High
- asseco infomedica plus Recoverable passwords in Asseco Infomedica Plus 5.9 Medium
- manager-io manager NetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential Recovery 8.4 High
- siemens sipass integrated A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server... 6.7 Medium
- newforma project center Newforma Info Exchange (NIX) insufficiently protected credentials 4.8 Medium
- hcl software compass HCL Compass is affected by a security vulnerability 7.5 High
- xwiki, xwiki xwiki-platform +1 more XWiki PDF export jobs store sensitive cookies unencrypted in job statuses 5.8 Medium
- commvault commcell, commvault +1 more Vulnerability in Initial Administrator Login Process 5.3 Medium
- amazon emr Privilege escalation issue in Amazon EMR Secret Agent component 9.0 Critical
- commscope ruckus network director, ruckus network director +1 more RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format. 5.3 Medium
- ivanti endpoint manager Improper Encryption in Ivanti Endpoint Manager 8.4 High
- ivanti endpoint manager Improper Encryption in Ivanti Endpoint Manager 8.4 High
- endress meac300-fnade4 firmware, endress+hauser meac300-fnade4 +1 more CVE-2025-27459 4.4 Medium
- abb aspect-enterprise, matrix series, nexus series +2 more Weak Password Storage 7.1 High
- macro-video v380 pro An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro... 3.4 Low
- fortinet fortios, siemens ruggedcom ape1808 +1 more A storing passwords in a recoverable format in Fortinet FortiOS versions 7.2.0 through 7.2.1... 2.1 Low
- inaba denki sangyo co., ltd. choco tei watcher mini (ib-mct001) Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all... 4.6 Medium
- simple sa simple.erp Privilege Escalation in SIMPLE.ERP 7.7 High
- sharp corporation multiple mfps (multifunction printers) User passwords are decrypted and stored on memory before any user logged in. Those decrypted... 5.9 Medium
- cisco ata 191 firmware, ata 192 firmware, analog telephone adaptor (ata) software +2 more Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure Vulnerability 5.5 Medium
- topquadrant topbraid edg TopQuadrant TopBraid EDG password manager stores external credentials insecurely 3.0 Low
- smub wp mail smtp by wpforms – the most popular smtp and email log plugin WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure 2.7 Low
- johnson controls american dynamics illustra essentials gen 4, johnsoncontrols illustra essential gen 4 firmware +1 more American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interface 6.8 Medium
- johnson controls american dynamics illustra essentials gen 4, johnsoncontrols illustra essential gen 4 firmware +1 more American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - Linux 6.8 Medium
- wp-ecommerce easy wp smtp, smub easy wp smtp – wordpress smtp and email logs: gmail, office 365, outlook, custom smtp, and more +1 more Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI 2.7 Low
- cyberpower powerpanel, powerpanel business +1 more CyberPower PowerPanel business Storing Passwords in a Recoverable Format 4.9 Medium
- kemptechnologies loadmaster LoadMaster Reversible Password Encryption Algorithm 6.4 Medium
- claris filemaker server Claris International has successfully resolved an issue of potentially exposing password... 4.9 Medium
- unitronics vision120, vision230, vision280 +2 more +4 more Unitronics Vision Standard Unauthenticated Password Retrieval 7.5 High
- ibm openpages with watson IBM OpenPages with Watson information disclosure 6.8 Medium
- ibm security verify access appliance, security verify access docker, security verify access +2 more IBM Security Access Manager Container information disclosure 5.1 Medium
- moxa nport 6000 series, nport 6000, nport 6150-t firmware +26 more +28 more Incorrect Implementation of Authentication Algorithm Vulnerability 7.5 High
- hitachi vantara pentaho business analytics server, hitachivantara pentaho business analytics +1 more Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format 4.3 Medium
- bd alaris infusion central The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password... 7.3 High
- pimcore pimcore/customer-data-framework, customer management framework +1 more Storing Passwords in a Recoverable Format in pimcore/customer-data-framework 6.7 Medium
- schweitzer engineering laboratories sel-2241 rtac module, sel-3350, sel-3505 +17 more +19 more Storing Passwords in a Recoverable Format 8.0 High
- Show olderLoading…