Patchfirst
Patchfirst
T1552Credential Access

Unsecured Credentials

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

attack.mitre.org ↗
CVEs24
In 15
Reports1
Sub-techniques T1552.001Credentials In Files10T1552.002Credentials in RegistryT1552.003Shell HistoryT1552.004Private Keys1T1552.005Cloud Instance Metadata APIT1552.006Group Policy Preferences1T1552.007Container APIT1552.008Chat Messages

Detections

13 Sigma rules tagged T1552
Unsecured CredentialsT155213 general rules
All 13 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Unsecured Credentials

24 CVEs, by priority. Each link shows its badge.
  1. CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
    F5 · BIG-IPKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more · 5 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    89.9priority
  2. CVE-2024-21887Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
    Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 more · 4 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    88.4priority
  3. CVE-2021-30116Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability
    Kaseya · Virtual System/Server Administrator (VSA)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1552Unsecured Credentials1 report
    AI mapping from the description · primary impact
    85.7%Top 0.27%
    83.7priority
  4. CVE-2022-24990TerraMaster OS Remote Command Execution Vulnerability
    TerraMaster · TerraMaster OSKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1552Unsecured Credentials
    AI mapping from the description · primary impact
    83.2%Top 0.32%
    78.2priority
  5. CVE-2019-6693Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
    Fortinet · FortiOSKEVRansomwarePublic exploitMedium · 6.5T1552Unsecured CredentialsT1555Credentials from Password Stores
    AI mapping from the description · how it is exploited
    6.6%Top 6.1%
    76.3priority
  6. CVE-2017-9248Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
    Progress · ASP.NET AJAX and SitefinityKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1552Unsecured Credentials
    AI mapping from the description · primary impact
    75.1%Top 0.49%
    69.8priority
  7. CVE-2024-20439Cisco Smart Licensing Utility Static Credential Vulnerability
    Cisco · Smart Licensing UtilityKEVPublic exploitCritical · 9.8T1106Native APIT1552Unsecured Credentials
    MITRE CTID mapping of the KEV entry · how it is exploited
    97.1%Top 0.11%
    69.8priority
  8. CVE-2024-3272D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability
    D-Link · Multiple NAS DevicesKEVPublic exploitCritical · 9.8T1078Valid AccountsT1552Unsecured Credentials
    AI mapping from the description · how it is exploited
    98.1%Top 0.09%
    69.8priority
  9. CVE-2017-5521NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
    NETGEAR · Multiple DevicesKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1552Unsecured Credentials
    AI mapping from the description · primary impact
    89.4%Top 0.22%
    68.6priority
  10. CVE-2023-28432MinIO Information Disclosure Vulnerability
    MinIO · MinIOKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1552Unsecured Credentials
    AI mapping from the description · primary impact
    84.0%Top 0.31%
    68.2priority
  11. CVE-2023-49103ownCloud graphapi Information Disclosure Vulnerability
    ownCloud · ownCloud graphapiKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1552Unsecured Credentials+1 more
    MITRE CTID mapping of the KEV entry · primary impact
    77.8%Top 0.43%
    68.2priority
  12. CVE-2026-20128Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
    Cisco · Catalyst SD-WAN ManagerKEVHigh · 7.5T1190Exploit Public-Facing ApplicationT1552Unsecured Credentials
    AI mapping from the description · primary impact
    7.3%Top 5.6%
    67.1priority
  13. CVE-2019-18988TeamViewer Desktop Bypass Remote Login Vulnerability
    TeamViewer · DesktopKEVPublic exploitHigh · 7.0T1078Valid AccountsT1552Unsecured Credentials
    AI mapping from the description · primary impact
    4.7%Top 8.2%
    66.3priority
  14. CVE-2023-50224TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
    TP-Link · TL-WR841NKEVMedium · 6.5T1190Exploit Public-Facing ApplicationT1552Unsecured Credentials
    AI mapping from the description · primary impact
    20.0%Top 2.6%
    62.0priority
  15. CVE-2011-4723D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability
    D-Link · DIR-300 RouterKEVMedium · 5.7T1078Valid AccountsT1552Unsecured Credentials
    AI mapping from the description · primary impact
    3.1%Top 12%
    59.5priority
  16. CVE-2018-15797NFS Volume release errand leaks cf admin credentials in logs
    Cloud Foundry · NFS Volume ReleaseHigh · 8.4T1068Exploitation for Privilege EscalationT1552Unsecured Credentials
    MITRE CTID mapping of the CVE · how it is exploited
    1.6%Top 25%
    21.0priority
  17. CVE-2019-3787UAA defaults email address to an insecure domain
    Cloud Foundry · UAA Release (OSS)High · 8.3T1078Valid AccountsT1098Account Manipulation+1 more
    MITRE CTID mapping of the CVE · primary impact
    1.1%Top 34%
    18.9priority
  18. CVE-2018-17900Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application…
    Yokogawa · STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500T1078Valid AccountsT1552Unsecured Credentials
    MITRE CTID mapping of the CVE · primary impact
    1.9%Top 21%
    15.9priority
  19. CVE-2020-15105In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session
    Bouke · django-two-factor-authMedium · 5.4T1078Valid AccountsT1552Unsecured Credentials
    MITRE CTID mapping of the CVE · primary impact
    0.7%Top 47%
    14.4priority
  20. CVE-2018-11088Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and…
    Pivotal · Application ServiceT1068Exploitation for Privilege EscalationT1552Unsecured Credentials
    MITRE CTID mapping of the CVE · primary impact
    1.0%Top 38%
    12.3priority
  21. CVE-2020-12008Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to…
    T1552Unsecured Credentials
    MITRE CTID mapping of the CVE · primary impact
    0.9%Top 39%
    12.2priority
  22. CVE-2019-3763The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08…
    Dell · RSA Identity Governance and LifecycleHigh · 8.8T1078Valid AccountsT1552Unsecured Credentials
    MITRE CTID mapping of the CVE · primary impact
    0.3%Top 75%
    11.3priority
  23. CVE-2020-15095Sensitive information exposure through logs in npm cli
    npm · cliMedium · 4.4T1552Unsecured Credentials
    MITRE CTID mapping of the CVE · primary impact
    0.4%Top 65%
    10.0priority
  24. CVE-2019-6549An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to…
    ICS-CERT · PR100088 Modbus gatewayT1078Valid AccountsT1552Unsecured Credentials
    MITRE CTID mapping of the CVE · primary impact
    0.6%Top 52%
    9.7priority

Linked through a sub-technique

11 more
  1. CVE-2019-11510Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
    Ivanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1133External Remote ServicesT1059Command and Scripting Interpreter+2 more · 6 reports
    >99.9%Top 0.01%
    90.0priority
  2. CVE-2022-26138Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
    Atlassian · ConfluenceKEVPublic exploitCritical · 9.8T1552.001Credentials In Files1 report
    98.2%Top 0.08%
    83.7priority
  3. CVE-2014-1812Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 8.8T1078Valid AccountsT1552.006Group Policy Preferences1 report
    65.1%Top 0.75%
    82.9priority
  4. CVE-2026-33634Aquasecurity Trivy Embedded Malicious Code Vulnerability
    Aquasecurity · TrivyKEVPublic exploitHigh · 8.8T1195.002Compromise Software Supply ChainT1552.001Credentials In Files2 reports
    59.7%Top 0.87%
    80.1priority
  5. CVE-2024-57727SimpleHelp Path Traversal Vulnerability
    SimpleHelp · SimpleHelpKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+3 more
    96.8%Top 0.11%
    78.2priority
  6. CVE-2025-30066tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
    tj-actions · changed-files GitHub ActionKEVPublic exploitHigh · 8.6T1195.002Compromise Software Supply ChainT1552.001Credentials In Files
    72.1%Top 0.57%
    68.9priority
  7. CVE-2025-30154reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
    reviewdog · action-setup GitHub ActionKEVPublic exploitHigh · 8.6T1195.002Compromise Software Supply ChainT1552.001Credentials In Files
    2.5%Top 15%
    65.9priority
  8. CVE-2020-3240Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
    Cisco · Cisco UCS DirectorCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+4 more
    38.7%Top 1.4%
    26.6priority
  9. CVE-2019-3780Cloud Foundry Container Runtime Leaks IAAS Credentials
    Cloud Foundry · Cloud Foundry Container Runtime (CFCR)Critical · 9.1T1068Exploitation for Privilege EscalationT1552.001Credentials In Files
    1.4%Top 27%
    21.0priority
  10. CVE-2018-7520An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline…
    Geutebrück · Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmwareT1552.001Credentials In Files
    1.6%Top 25%
    15.1priority
  11. CVE-2019-3782CredHub CLI writes environment variable credentials to disk
    Cloud Foundry · CredHub CLIMedium · 6.3T1098Account ManipulationT1552.001Credentials In Files
    0.4%Top 71%
    10.3priority

Passages that support these links

↑ ↓ chooseEnter openEsc close