CWE-912
4 CVEs of this weakness class.
Show as table
| Year published | CVEs | In CISA KEV |
|---|---|---|
| 2021 | 1 | 1 |
| 2022 | 0 | 0 |
| 2023 | 0 | 0 |
| 2024 | 1 | 1 |
| 2025 | 2 | 1 |
Exploitation first, with newly exploited CVEs rising above old ones
- CVE-2024-20439CRIT 9.8KEVEPSS 97%
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.
- CVE-2025-47729LOW 1.9KEVEPSS 0%
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.
- CVE-2021-25371MED 6.1KEVEPSS 1%
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
- CVE-2010-20103CRIT 9.8EPSS 5%
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.