Storing Passwords in a Recoverable Format
CWE-257
The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
We track 20 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Use strong, non-reversible encryption to protect stored passwords.
Latest Storing Passwords in a Recoverable Format vulnerabilities
- 7.5 High severity
700 Series: Storing Passwords in a Recoverable Format
Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.
- 7.5 High severity
HIPASE-250: Storing Passwords in a Recoverable Format
ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all s
- 9.1 Critical severity
OpenEdge: Storing Passwords in a Recoverable Format
The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immed
- 7.5 High severity
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Exploited
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for th
- 7.0 High severity
WebCTRL: Storing Passwords in a Recoverable Format
Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE-257) in the Web session management component allows an attacker to access store
- 8.4 High severity
Manager: Storing Passwords in a Recoverable Format
NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key is stored using a reversible encoding scheme. An attacker who obtains access to a deployed client con
- 7.5 High severity
xwiki-platform: Improper Removal of Sensitive Information Before Storage or Transfer
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies
- 8.5 High severity
EMR: Storing Passwords in a Recoverable Format
Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges. Users are ad
- 8.4 High severity
Endpoint Manager: Storing Passwords in a Recoverable Format
Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
- 8.4 High severity
Endpoint Manager: Storing Passwords in a Recoverable Format
Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
- 7.5 High severity
Endress+Hauser MEAC300-FNADE4: Storing Passwords in a Recoverable Format
The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered.
- 7.7 High severity
SIMPLE.ERP: Storing Passwords in a Recoverable Format
The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch
- 7.5 High severity
PowerPanel business: Storing Passwords in a Recoverable Format
The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered.
- 7.5 High severity
LoadMaster: Insufficiently Protected Credentials
Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.
- 8.1 High severity
OpenPages with Watson: Storing Passwords in a Recoverable Format
IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is using Native authentication an attacker with access to the OpenPages database could through a series of sp
- 7.5 High severity
NPort 6000 Series: Improper Authentication
A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users to gain unauthorized
- 7.3 High severity
Alaris Infusion Central: Insufficiently Protected Credentials
The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data.
- 9.8 Critical severity
Data Center Expert: Insufficiently Protected Credentials
A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. Affected Products: Data Center Expert (Versions prior to V7.9.0)
- 7.8 High severity
Junos OS: Insufficiently Protected Credentials
On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Juniper Networks Junos OS allows a local, low-privileged attacker to elevate their permissions to take con
- 8.4 High severity
ABB Zenon: Insufficiently Protected Credentials
Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data points and corresponding attributes. Once such engineering data is used the data visualization will be