CVE-2024-20489

MEDIUM Year: 2024
CVSS v3 Score
5.5
Medium
Weakness Type
CWE-256
View all →

Vulnerability Description

A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unencrypted database credentials on the device that is running Cisco IOS XR Software. An attacker could exploit this vulnerability by accessing the configuration files on an affected system. A successful exploit could allow the attacker to view MongoDB credentials.

Related Vulnerabilities

CVE-2019-0072

MEDIUM
CVSS:5.5(Medium)

An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issu...

CWE-2562019

CVE-2019-19105

MEDIUM
CVSS:5.5(Medium)

The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application, including credentials of existing user a...

CWE-2562019

CVE-2020-25184

MEDIUM
CVSS:5.5(Medium)

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the d...

CWE-2562020

CVE-2021-1126

MEDIUM
CVSS:5.5(Medium)

A vulnerability in the storage of proxy server credentials of Cisco Firepower Management Center (FMC) could allow an authenticated, local attacker to view credentials for a configured proxy server. Th...

CWE-2562021

CVE-2021-23207

MEDIUM
CVSS:5.5(Medium)

An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate...

CWE-2562021

CVE-2022-1794

MEDIUM
CVSS:5.5(Medium)

The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windows users of the system.

CWE-2562022