cve.bz

CWE-257: Storing Passwords in a Recoverable Format

Filter

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

What the weakness is: CWE-257 at MITRE. All weaknesses

Related attack patterns (CAPEC): 1
  • CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-257, as MITRE names them. Credits.

Ask an AI about CWE-257

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-257: Storing Passwords in a Recoverable Format and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/257.html and https://cve.bz/cve/cwe/257?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.3CVE-2026-28745EPSS 0.2%

    Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.

  2. 5.3CVE-2026-103548EPSS 0.10%

    Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.

  3. 6.5CVE-2026-69297EPSS 0.8%

    Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network.

  4. 4.7CVE-2026-80176EPSS 0.1%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit …

  5. 7.5CVE-2026-65309EPSS 0.2%

    ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network tra…

  6. 5.3CVE-2026-1836EPSS 0.1%

    The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.

  7. 6.5CVE-2026-22576EPSS 0.3%

    A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 thro…

  8. 6.5CVE-2026-22574EPSS 0.3%

    A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 thro…

  9. 9.1CVE-2025-8095EPSS 0.2%

    The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform.  It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications.  OECH1 encodings should be considere…

  10. 8.6CVE-2016-15058EPSS 0.2%

    Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community st…

  11. 6.1CVE-2026-22614EPSS 0.09%

    The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine could potentially read the sensitive information stored and…

  12. 8.2CVE-2026-30785EPSS 0.10%

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbb_common on Windows, MacOS,…

  13. 7.5CVE-2026-20128KEVEPSS 8.3%

    A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of …

  14. 6.8CVE-2025-57796EPSS 0.2%

    Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted off…

  15. 7.0CVE-2025-14295EPSS 0.2%

    Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE-257) in the Web session management component allows an att…

  16. 5.9CVE-2025-8307EPSS 0.1%

    Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded p…

  17. 8.4CVE-2025-34180EPSS 0.2%

    NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key is stored using a reversible encoding scheme. An attacker who obtains access to…

  18. 6.7CVE-2025-40774EPSS 0.1%

    A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted in its database. Decryption keys are accessible to users with administrative privileges, allowing t…

  19. 4.8CVE-2025-35054EPSS 0.08%

    Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authentica…

  20. 7.5CVE-2025-0280EPSS 0.1%

    A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.

  21. 7.5CVE-2025-58049EPSS 0.4%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs st…

  22. 5.3CVE-2025-57789ExploitEPSS 1.2%

    During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.

  23. 9.0CVE-2025-8904EPSS 0.4%

    Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher pri…

  24. 7.5CVE-2025-44958EPSS 0.4%

    RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format.

  25. 8.4CVE-2025-6996EPSS 0.2%

    Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.

  26. 8.4CVE-2025-6995EPSS 0.2%

    Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.

  27. 7.5CVE-2025-27459EPSS 0.2%

    The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered.

  28. 7.1CVE-2024-51552EPSS 0.3%

    Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

  29. 3.4CVE-2025-25983EPSS 0.3%

    An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive information via the QE code based sharing component.

  30. 4.4CVE-2024-32122EPSS 0.2%

    A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP …

  31. 4.6CVE-2025-24852EPSS 0.3%

    Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can access the microSD card used on the product may obtain the product login password.

  32. 7.7CVE-2024-8774EPSS 0.3%

    The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 ver…

  33. 5.9CVE-2024-32151EPSS 1.3%

    User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the informa…

  34. 5.5CVE-2024-20462EPSS 0.2%

    A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, local attacker with low privileges to view passwords on an affected device. This…

  35. 4.3CVE-2024-45744EPSS 0.2%

    TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authent…

  36. 2.7CVE-2024-6694EPSS 0.6%

    The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it …

  37. 6.8CVE-2024-32932EPSS 0.4%

    Under certain circumstances the web interface users credentials may be recovered by an authenticated user.

  38. 6.8CVE-2024-32756EPSS 0.4%

    Under certain circumstances the Linux users credentials may be recovered by an authenticated user.

  39. 2.7CVE-2024-3073EPSS 0.3%

    The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Passw…

  40. 7.5CVE-2024-32042EPSS 0.4%

    The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered.

  41. 4.9CVE-2023-42955EPSS 0.4%

    Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.…

  42. 7.5CVE-2024-3543EPSS 0.3%

    Use of reversible password encryption algorithm allows attackers to decrypt passwords.  Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.

  43. 7.5CVE-2024-1480EPSS 0.5%

    Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication.

  44. 8.1CVE-2023-38738EPSS 0.5%

    IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is using Native authentication an attacker with access to the OpenPages database could t…

  45. 5.5CVE-2023-31001EPSS 0.2%

    IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user.…

  46. 7.5CVE-2023-5627EPSS 0.4%

    A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users…

  47. 4.9CVE-2023-2358EPSS 0.3%

    Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext.

  48. 7.3CVE-2022-47376EPSS 0.2%

    The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data.

  49. 4.9CVE-2023-2881EPSS 0.5%

    Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

  50. 6.5CVE-2023-31150EPSS 0.5%

    A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database system could allow an authenticated attacker to retrieve passwords. See SEL Service Bu…