Skip to content
OpenAdvisories

Weakness (CWE)

CWE-522: Insufficiently Protected Credentials

Class Incomplete

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Use an appropriate security mechanism to protect the credentials.

  2. Architecture and Design

    Make appropriate use of cryptography to protect the credentials.

  3. Implementation

    Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

Source: MITRE CWE-522

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-22681 Exploited Public exploit EPSS 64%

    Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key…

    KEV Mar 5, 2026
  • Critical 9.8
    CVE-2020-29583 Exploited Public exploit EPSS 90%

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-9248 Exploited Public exploit EPSS 75%

    Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does no…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2014-1812 Exploited · Ransomware Public exploit EPSS 65%

    The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Wind…

    KEV Nov 3, 2021