618
At least one OT product stored a password in plaintext.
Observed Examples
Reference Description
CVE-2022-30275 Remote Terminal Unit (RTU) uses a driver that relies on a password stored in
plaintext.
https://www.cve.org/CVERecord?id=CVE-2022-30275
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 254 7PK - Security Features 700 2314
MemberOf 930 OWASP Top Ten 2013 Category A2 - Broken
Authentication and Session Management
928 2389
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1028 OWASP Top Ten 2017 Category A2 - Broken
Authentication
1026 2436
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Password Management
Software Fault Patterns SFP23 Exposed Data
ISA/IEC 62443 Part 4-2 Req CR 1.5
ISA/IEC 62443 Part 3-3 Req SR 1.5
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-207]John Viega and Gary McGraw. "Building Secure Software: How to Avoid Security
Problems the Right Way". 1st Edition. 2002. Addison-Wesley.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
CWE-257: Storing Passwords in a Recoverable Format
Weakness ID : 257
Structure : Simple
Abstraction : Base
Description
The storage of passwords in a recoverable format makes them subject to password reuse attacks
by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no
significant benefit over plaintext passwords since they are subject not only to reuse by malicious
attackers but also by malicious insiders. If a system administrator can recover a password directly,
CWE Version 4.14
CWE-257: Storing Passwords in a Recoverable Format
CWE-257: Storing Passwords in a Recoverable Format