CWE-257 · Authentication
Storing Passwords in a Recoverable Format
68CVEs
SortMost likely exploited
68 CVEs with CWE-257 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-20128In CISA KEVExploitedCisco Catalyst SD-WAN Manager Information Disclosure VulnerabilityCisco · Cisco Catalyst SD-WAN Manager · CVSS 7.5 · 2026-02-25 | 7.5 | 8.3% | 2026-02-25 |
| CVE-2025-57789CheckCommvault Initial Administrator Login Process VulnerabilityCommvault · CommCell · CVSS 5.3 · 2025-08-20 | 5.3 | 1.2% | 2025-08-20 |
| CVE-2023-23382Azure Machine Learning Compute Instance Information Disclosure VulnerabilityMicrosoft · Azure Machine Learning · CVSS 6.5 · 2023-02-14 | 6.5 | 2.7% | 2023-02-14 |
| CVE-2019-1010241Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The…Jenkins Credentials Binding Plugin · Jenkins · 2019-07-19 | – | 1.4% | 2019-07-19 |
| CVE-2024-32151User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected prod…Sharp Corporation · Multiple MFPs (multifunction printers) · CVSS 5.9 · 2024-11-26 | 5.9 | 1.3% | 2024-11-26 |
| CVE-2021-0220Junos Space: Shared secrets stored in recoverable format and directly exposed through the UIJuniper Networks · Junos Space · CVSS 6.8 · 2021-01-15 | 6.8 | 1.2% | 2021-01-15 |
| CVE-2021-27485ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retrieve the credentia…Zoll · ZOLL Defibrillator Dashboard · 2021-06-16 | – | 1.2% | 2021-06-16 |
| CVE-2021-35050User Credentials Stored in a Recoverable Format within Fidelis Network and DeceptionFidelis Cybersecurity · Fidelis Network · CVSS 6.5 · 2021-06-25 | 6.5 | 1.0% | 2021-06-25 |
| CVE-2026-69297Windows DHCP Server Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 6.5 · 2026-09-08 | 6.5 | 0.8% | 2026-09-08 |
| CVE-2019-5615Rapid7 InsightVM Stored Credential ExposureRapid7 · InsightVM · CVSS 3.1 · 2019-04-09 | 3.1 | 0.8% | 2019-04-09 |
| CVE-2019-3736Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malicious user with root…Dell · Integrated Data Protection Appliance · CVSS 8.2 · 2019-09-27 | 8.2 | 0.7% | 2019-09-27 |
| CVE-2024-6694WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposuresmub · WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin · CVSS 2.7 · 2024-07-20 | 2.7 | 0.6% | 2024-07-20 |
| CVE-2023-2881Storing Passwords in a Recoverable Format in pimcore/customer-data-frameworkpimcore · pimcore/customer-data-framework · CVSS 6.7 · 2023-05-25 | 6.7 | 0.5% | 2023-05-25 |
| CVE-2023-38738IBM OpenPages with Watson information disclosureIBM · OpenPages with Watson · CVSS 6.8 · 2024-01-19 | 6.8 | 0.5% | 2024-01-19 |
| CVE-2020-8296Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.Nextcloud · Nextcloud Server · 2021-03-03 | – | 0.5% | 2021-03-03 |
| CVE-2024-1480Unitronics Vision Standard Unauthenticated Password RetrievalUnitronics · Vision230 · CVSS 7.5 · 2024-04-19 | 7.5 | 0.5% | 2024-04-19 |
| CVE-2022-32519A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third…Schneider Electric · Data Center Expert · CVSS 8 · 2023-01-30 | 8.0 | 0.5% | 2023-01-30 |
| CVE-2023-31150Storing Passwords in a Recoverable FormatSchweitzer Engineering Laboratories · SEL-3505 · CVSS 8 · 2023-05-10 | 8.0 | 0.5% | 2023-05-10 |
| CVE-2023-21726Windows Credential Manager User Interface Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.8 · 2023-01-10 | 7.8 | 0.5% | 2023-01-10 |
| CVE-2023-42955Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console with an administrato…Claris · FileMaker Server · CVSS 6.1 · 2024-04-26 | 6.1 | 0.4% | 2024-04-26 |
| CVE-2023-0353CVE-2023-0353Akuvox · E11 · CVSS 7.2 · 2023-03-13 | 7.2 | 0.4% | 2023-03-13 |
| CVE-2025-8904Privilege escalation issue in Amazon EMR Secret Agent componentAmazon · EMR · CVSS 8.5 · 2025-08-13 | 8.5 | 0.4% | 2025-08-13 |
| CVE-2018-5446Medtronic 2090 Carelink Programmer Storing Passwords in a Recoverable FormatMedtronic · 2090 CareLink Programmer · CVSS 4.9 · 2018-05-04 | 4.9 | 0.4% | 2018-05-04 |
| CVE-2024-32932American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interfaceJohnson Controls · American Dynamics Illustra Essentials Gen 4 · CVSS 6.8 · 2024-07-02 | 6.8 | 0.4% | 2024-07-02 |
| CVE-2024-32042CyberPower PowerPanel business Storing Passwords in a Recoverable FormatCyberPower · PowerPanel business · CVSS 4.9 · 2024-05-15 | 4.9 | 0.4% | 2024-05-15 |
| CVE-2025-44958RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format.RUCKUS · Network Director · CVSS 5.3 · 2025-08-04 | 5.3 | 0.4% | 2025-08-04 |
| CVE-2019-18256BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. An attacker with physical access to the CardioMe…Biotronik · BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S GSM · 2020-06-29 | – | 0.4% | 2020-06-29 |
| CVE-2024-32756American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - LinuxJohnson Controls · American Dynamics Illustra Essentials Gen 4 · CVSS 6.8 · 2024-07-02 | 6.8 | 0.4% | 2024-07-02 |
| CVE-2024-8774Privilege Escalation in SIMPLE.ERPSimple SA · SIMPLE.ERP · CVSS 7.7 · 2025-03-24 | 7.7 | 0.3% | 2025-03-24 |
| CVE-2024-3073Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UIsmub · Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custo… · CVSS 2.7 · 2024-06-13 | 2.7 | 0.3% | 2024-06-13 |
| CVE-2024-51552Weak Password StorageABB · ASPECT-Enterprise · CVSS 6 · 2025-05-22 | 6.0 | 0.3% | 2025-05-22 |
| CVE-2025-25983An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive information via the…Macro-Video · V380 Pro · CVSS 3.4 · 2025-04-18 | 3.4 | 0.3% | 2025-04-18 |
| CVE-2025-24852Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can access the microSD card…Inaba Denki Sangyo Co., Ltd. · CHOCO TEI WATCHER mini (IB-MCT001) · CVSS 4.6 · 2025-03-31 | 4.6 | 0.3% | 2025-03-31 |
| CVE-2019-6567A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants…Siemens · SCALANCE X-200 switch family (incl. SIPLUS NET variants) · 2019-06-12 | – | 0.3% | 2019-06-12 |
| CVE-2019-19096ABB eSOMS: REDIS clear text credentialsABB · eSOMS · CVSS 6.1 · 2020-04-02 | 6.1 | 0.3% | 2020-04-02 |
| CVE-2023-2358Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable FormatHitachi Vantara · Pentaho Business Analytics Server · CVSS 4.3 · 2023-09-26 | 4.3 | 0.3% | 2023-09-26 |
| CVE-2026-22574A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, Fort…Fortinet · FortiSOAR PaaS · CVSS 4.1 · 2026-04-14 | 4.1 | 0.3% | 2026-04-14 |
| CVE-2024-3543LoadMaster Reversible Password Encryption AlgorithmProgress Software Corporation · LoadMaster · CVSS 6.4 · 2024-05-02 | 6.4 | 0.3% | 2024-05-02 |
| CVE-2017-9942A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated server or SiPass in…Siemens · SiPass integrated All versions before V2.70 · 2017-08-08 | – | 0.3% | 2017-08-08 |
| CVE-2026-22576A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, Fort…Fortinet · FortiSOAR on-premise · CVSS 4.1 · 2026-04-14 | 4.1 | 0.3% | 2026-04-14 |
| CVE-2022-46142Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the CLI user passwords.Siemens · RUGGEDCOM RM1224 LTE(4G) EU · CVSS 5.7 · 2022-12-13 | 5.7 | 0.3% | 2022-12-13 |
| CVE-2025-27459CVE-2025-27459Endress+Hauser · Endress+Hauser MEAC300-FNADE4 · CVSS 4.4 · 2025-07-03 | 4.4 | 0.2% | 2025-07-03 |
| CVE-2016-15058Hirschmann HiLCOS Classic Platform Password Exposure via SNMPBelden · Hirschmann HiLCOS Classic Platform · CVSS 8.1 · 2026-04-03 | 8.1 | 0.2% | 2026-04-03 |
| CVE-2024-45744TopQuadrant TopBraid EDG password manager stores external credentials insecurelyTopQuadrant · TopBraid EDG · CVSS 3 · 2024-09-27 | 3.0 | 0.2% | 2024-09-27 |
| CVE-2024-32122A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker t…Fortinet · FortiOS · CVSS 2.1 · 2025-04-08 | 2.1 | 0.2% | 2025-04-08 |
| CVE-2026-28745Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable FormatRed Lion Controls · 700 Series · CVSS 7.5 · 2026-10-09 | 7.5 | 0.2% | 2026-10-09 |
| CVE-2023-31001IBM Security Access Manager Container information disclosureIBM · Security Verify Access Appliance · CVSS 5.1 · 2024-01-11 | 5.1 | 0.2% | 2024-01-11 |
| CVE-2025-57796Use of a hardcoded static key to protect sensitive data in Explorance BlueExplorance · Blue · CVSS 6.8 · 2026-01-28 | 6.8 | 0.2% | 2026-01-28 |
| CVE-2025-8095Recoverable obfuscation using the OECH1 prefix encoding in OpenEdgeProgress Software Corporation · OpenEdge · CVSS 9.1 · 2026-04-14 | 9.1 | 0.2% | 2026-04-14 |
| CVE-2025-6996Improper Encryption in Ivanti Endpoint ManagerIvanti · Endpoint Manager · CVSS 8.4 · 2025-07-08 | 8.4 | 0.2% | 2025-07-08 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.