Storing Passwords in a Recoverable Format

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

CVEs (65)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-6567 1Siemens 4Scalance X 200 Firmware Scalance X 200irt FirmwareScalance X 300 Firmware+1 more Jun 17, 2026 Jun 12, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300...Show more A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3), SCALANCE X-414-3E (All versions). The affected devices store passwords in a recoverable format. An attacker may extract and recover device passwords from the device configuration. Successful exploitation requires access to a device configuration backup and impacts confidentiality of the stored passwords.Show less
CVE-2019-5615 1Rapid7 1Insightvm Jun 17, 2026 Apr 9, 2019 N/A· v4 6.5 MEDIUM· v3 3.5 LOW· v2 Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passw...Show more Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49.Show less
CVE-2018-10622 1Medtronic 2Mycarelink 24950 Patient Monitor Firmware Mycarelink 24952 Patient Monitor Firmware Jun 22, 2026 Aug 10, 2018 N/A· v4 7.1 HIGH· v3 1.9 LOW· v2 Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network authentication.
CVE-2018-5446 1Medtronic 12090 Carelink Programmer Firmware Jun 17, 2026 May 4, 2018 N/A· v4 5.3 MEDIUM· v3 2.1 LOW· v2 Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format.
CVE-2017-9942 1Siemens 1Sipass Integrated May 13, 2026 Aug 8, 2017 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated server or SiPass integrated client to potentially obtain cre...Show more A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated server or SiPass integrated client to potentially obtain credentials from the systems.Show less

Previous 1 2 34