Are you declaring p on the stack in this line and does it still exist when the handler is called?
CommandConfirm = new RelayCommand<object>((p) => ConfirmExecute(p), (p) => ConfirmCanExecute(p));
Because an incorrect command binding would certainly cause this to return null, creating the error you're seeing.
var passwordBox = parameter as PasswordBox;
Secondly, why have your ViewModel directly manipulate the View in this way? Simply 2-way bind the Password field to your ViewModel and your ViewModel's CanExecute handler becomes a one-liner, no?
return !String.IsNullOrEmpty(this.Password);