Monthly
Weak, reversible encryption of usernames and passwords stored in the configuration file of Red Lion Controls 700 Series devices lets an attacker who holds the documented default credentials read the configuration and recover additional system credentials for reuse elsewhere on the device or network. The affected product line is captured by CPE cpe:2.3:a:red_lion_controls:700_series:*:*:*:*:*:*:*:*, meaning the vendor tracks the issue at the product-line level rather than against a specific firmware build, and the flaw is classified as CWE-257 (storage of passwords in a recoverable format). Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network reachable but requiring the attacker to already possess valid credentials (PR:L), with confidentiality-only impact - which is substantially lower than the CVSS 4.0 base score of 9.3 reported in the source data; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided. Real-world risk therefore concentrates on deployments that retain default credentials and expose the management interface to untrusted networks, and on whether the recovered credentials are reused in a way that grants further access.
RustDesk Client through version 1.4.5 on Windows, macOS, and Linux uses weak password hashing and improper object prototype handling in its password security and configuration encryption modules, allowing local authenticated attackers to extract embedded sensitive data including passwords and machine identifiers. The vulnerability affects critical cryptographic functions including symmetric_crypt() and decrypt_str_or_original(), enabling attackers with local access and valid credentials to compromise encrypted credentials and system identifiers. No patch is currently available.
Privilege escalation in Cisco Catalyst SD-WAN Manager (versions prior to 20.18) enables authenticated local attackers with valid vmanage credentials to obtain Data Collection Agent (DCA) user privileges by reading an unprotected credential file from the filesystem. Confirmed actively exploited (CISA KEV) with publicly available exploit code despite low EPSS score (0.02%), indicating targeted attacks rather than widespread scanning. High-privileged initial access requirement (PR:H) and high attack complexity (AC:H) limit exploitability, but scope change (S:C) enables lateral movement to other SD-WAN systems.
Decodable credential storage in Itron MV-90 xi 3.0 lets an attacker who can read the product's configuration file recover stored passwords and password histories and then log in to MV-90 as any user, including privileged accounts. The attack is local, not remote: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) requires prior access to the host and a low-privileged account or equivalent filesystem read permission on the config file, after which no user interaction is needed, making this a privilege-escalation and lateral-movement primitive rather than an initial-access flaw. No public exploit has been identified at time of analysis (CISA SSVC records Exploitation: none), and the cross-vendor assessment rates technical impact as partial, so exploitation is opportunistic and contingent on the attacker already having a foothold with file-read access.
Windows DHCP Server on multiple Windows Server versions stores passwords in a recoverable format (CWE-257), enabling an authenticated low-privileged network attacker to extract those credentials over the network. The impact is a pure confidentiality breach - passwords held by the DHCP Server service can be recovered without cracking, potentially enabling lateral movement or privilege escalation through credential reuse. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing the flaw across the full affected version matrix.
Plaintext credential storage in Dell Secure Connect Gateway 5.0 exposes passwords to local low-privileged attackers, leading to information disclosure. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified; the CVSS score of 4.7 Medium reflects the local-only, high-complexity attack path.
Credential exposure in Redmine allows any local attacker with access to a previously-used browser session to recover plaintext login credentials stored by the application after form submission. The flaw (CWE-257) affects all tracked Redmine versions per NVD CPE data and represents a classic insecure credential storage issue. No public exploit has been identified at time of analysis, and exploitation is constrained to local attack vectors requiring prior user interaction.
Fortinet FortiSOAR stores LDAP service account passwords in a recoverable format, allowing authenticated high-privilege remote attackers to retrieve plaintext or weakly protected credentials by modifying the LDAP server address in configuration. This affects FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4. The vulnerability requires high-level administrative authentication and poses a confidentiality risk to stored credentials, with no evidence of active exploitation or public exploit code at time of analysis.
Fortinet FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4 store connector passwords in a recoverable format, allowing authenticated remote attackers to retrieve plaintext or weakly encrypted credentials for multiple installed connectors by modifying the server address in connector configuration. This affects security orchestration workflows that depend on connector authentication for external integrations.
Progress OpenEdge 12.2.0-12.2.18 and 12.8.0-12.8.9 expose stored passwords and secrets to decryption through cryptographically weak OECH1 prefix encoding. Remote unauthenticated attackers can exploit this weakness to recover obfuscated credentials and sensitive data (CVSS 9.1, VC:H/VI:H). No public exploit identified at time of analysis, but the vulnerability is automatable with total technical impact per SSVC framework, making credential harvesting straightforward once encoding is accessed.
Weak, reversible encryption of usernames and passwords stored in the configuration file of Red Lion Controls 700 Series devices lets an attacker who holds the documented default credentials read the configuration and recover additional system credentials for reuse elsewhere on the device or network. The affected product line is captured by CPE cpe:2.3:a:red_lion_controls:700_series:*:*:*:*:*:*:*:*, meaning the vendor tracks the issue at the product-line level rather than against a specific firmware build, and the flaw is classified as CWE-257 (storage of passwords in a recoverable format). Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network reachable but requiring the attacker to already possess valid credentials (PR:L), with confidentiality-only impact - which is substantially lower than the CVSS 4.0 base score of 9.3 reported in the source data; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided. Real-world risk therefore concentrates on deployments that retain default credentials and expose the management interface to untrusted networks, and on whether the recovered credentials are reused in a way that grants further access.
RustDesk Client through version 1.4.5 on Windows, macOS, and Linux uses weak password hashing and improper object prototype handling in its password security and configuration encryption modules, allowing local authenticated attackers to extract embedded sensitive data including passwords and machine identifiers. The vulnerability affects critical cryptographic functions including symmetric_crypt() and decrypt_str_or_original(), enabling attackers with local access and valid credentials to compromise encrypted credentials and system identifiers. No patch is currently available.
Privilege escalation in Cisco Catalyst SD-WAN Manager (versions prior to 20.18) enables authenticated local attackers with valid vmanage credentials to obtain Data Collection Agent (DCA) user privileges by reading an unprotected credential file from the filesystem. Confirmed actively exploited (CISA KEV) with publicly available exploit code despite low EPSS score (0.02%), indicating targeted attacks rather than widespread scanning. High-privileged initial access requirement (PR:H) and high attack complexity (AC:H) limit exploitability, but scope change (S:C) enables lateral movement to other SD-WAN systems.
Decodable credential storage in Itron MV-90 xi 3.0 lets an attacker who can read the product's configuration file recover stored passwords and password histories and then log in to MV-90 as any user, including privileged accounts. The attack is local, not remote: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) requires prior access to the host and a low-privileged account or equivalent filesystem read permission on the config file, after which no user interaction is needed, making this a privilege-escalation and lateral-movement primitive rather than an initial-access flaw. No public exploit has been identified at time of analysis (CISA SSVC records Exploitation: none), and the cross-vendor assessment rates technical impact as partial, so exploitation is opportunistic and contingent on the attacker already having a foothold with file-read access.
Windows DHCP Server on multiple Windows Server versions stores passwords in a recoverable format (CWE-257), enabling an authenticated low-privileged network attacker to extract those credentials over the network. The impact is a pure confidentiality breach - passwords held by the DHCP Server service can be recovered without cracking, potentially enabling lateral movement or privilege escalation through credential reuse. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing the flaw across the full affected version matrix.
Plaintext credential storage in Dell Secure Connect Gateway 5.0 exposes passwords to local low-privileged attackers, leading to information disclosure. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified; the CVSS score of 4.7 Medium reflects the local-only, high-complexity attack path.
Credential exposure in Redmine allows any local attacker with access to a previously-used browser session to recover plaintext login credentials stored by the application after form submission. The flaw (CWE-257) affects all tracked Redmine versions per NVD CPE data and represents a classic insecure credential storage issue. No public exploit has been identified at time of analysis, and exploitation is constrained to local attack vectors requiring prior user interaction.
Fortinet FortiSOAR stores LDAP service account passwords in a recoverable format, allowing authenticated high-privilege remote attackers to retrieve plaintext or weakly protected credentials by modifying the LDAP server address in configuration. This affects FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4. The vulnerability requires high-level administrative authentication and poses a confidentiality risk to stored credentials, with no evidence of active exploitation or public exploit code at time of analysis.
Fortinet FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4 store connector passwords in a recoverable format, allowing authenticated remote attackers to retrieve plaintext or weakly encrypted credentials for multiple installed connectors by modifying the server address in connector configuration. This affects security orchestration workflows that depend on connector authentication for external integrations.
Progress OpenEdge 12.2.0-12.2.18 and 12.8.0-12.8.9 expose stored passwords and secrets to decryption through cryptographically weak OECH1 prefix encoding. Remote unauthenticated attackers can exploit this weakness to recover obfuscated credentials and sensitive data (CVSS 9.1, VC:H/VI:H). No public exploit identified at time of analysis, but the vulnerability is automatable with total technical impact per SSVC framework, making credential harvesting straightforward once encoding is accessed.