CVE-2025-56565High· 7.6▾ MidnightPoC availableDD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory. The exposed material includes SSH private keys, dynamic DNS passwords, email n…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.8 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
— → 7.6
none → high
0.2% → 0.2%
DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory. The exposed material includes SSH private keys, dynamic DNS passwords, email notification credentials and administrative passwords. An attacker with physical access to the device can extract these credentials from an SPI flash dump, leading to device compromise, infiltration of the connected network and unauthorised access to dependent third-party services.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111993Low· 3.3Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage
CVE-2026-102539Medium· 5.7Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities
CVE-2026-62376High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2026-107807High· 8.8Nginx UI is a web user interface for the Nginx web server
CVE-2025-5154Low· 2.3A vulnerability was identified in PhonePe App 25.03.21.0 on Android
CVE-2023-22894Medium· 4.9Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter