# UNDF: UNDF-2026-000001181
--- a/subsys/net/lib/wifi_credentials/wifi_credentials_shell.c
+++ b/subsys/net/lib/wifi_credentials/wifi_credentials_shell.c
@@ -49,17 +49,17 @@ static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
 # Defect ID: zephyr-0001
 # MOAD: 0004
 # Severity: HIGH
 # CVE class: CWE-312 Cleartext Storage/Exposure of Sensitive Information
 #
 # Root cause: print_network_info() in wifi_credentials_shell.c retrieves stored
 # WiFi credentials and prints the plaintext PSK/password unconditionally via
 # shell_fprintf when the "wifi cred list" shell command is run:
 #
 #   line 57-59:  shell_fprintf(sh, ..., ", password: \"%.*s\", password_len: %d",
 #                              ..., creds.password, creds.password_len)
 #
 # For WPA2-PSK, WPA2-PSK-SHA256, SAE, and WPA-PSK security types the password
 # is emitted verbatim to the shell. Additionally for EAP-TLS enterprise mode:
 #
 #   line 65-68:  shell_fprintf(sh, ..., ", key_passwd: \"%.*s\"...",
 #                              ..., creds.header.key_passwd, ...)
 #
 # This exposes the private-key passphrase for enterprise TLS connections.
 #
 # On embedded systems with serial console or UART shell, any observer with
 # console access sees live credentials. On boards with logging backends that
 # write to flash or network syslog the credential is persisted in cleartext.
 #
 # Fix: replace the password and key_passwd fields with a redacted marker
 # ("[redacted]") when printing via the shell. The password_len is still
 # printed so the operator can verify a credential is set without exposing value.

+static const char REDACTED[] = "[redacted]";
+
 static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
 {
 	int ret = 0;
@@ -53,12 +53,12 @@ static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
 	if (creds.header.type == WIFI_SECURITY_TYPE_PSK ||
 	    creds.header.type == WIFI_SECURITY_TYPE_PSK_SHA256 ||
 	    creds.header.type == WIFI_SECURITY_TYPE_SAE ||
 	    creds.header.type == WIFI_SECURITY_TYPE_WPA_PSK) {
 		shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT,
-			      ", password: \"%.*s\", password_len: %d", (int)creds.password_len,
-			      creds.password, creds.password_len);
+			      ", password: %s, password_len: %d",
+			      REDACTED, creds.password_len);
 	}

 #ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
 	if (creds.header.type == WIFI_SECURITY_TYPE_EAP_TLS) {
 		if (creds.header.key_passwd_length > 0) {
 			shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT,
-				      ", key_passwd: \"%.*s\", key_passwd_len: %d",
-				      creds.header.key_passwd_length, creds.header.key_passwd,
-				      creds.header.key_passwd_length);
+				      ", key_passwd: %s, key_passwd_len: %d",
+				      REDACTED, creds.header.key_passwd_length);
 		}