Skip to content
OpenAdvisories
Medium · 5.5 CVE-2024-10404 EUVD-2025-4906GHSA-gq57-6x2p-wrx3

Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave

Published Feb 14, 2025 · Updated Feb 14, 2025 · Assigned by brocade

Description

CalInvocationHandler in Brocade
SANnav before 2.3.1b logs sensitive information in clear text. The
vulnerability could allow an authenticated, local attacker to view
Brocade Fabric OS switch sensitive information in clear text. An
attacker with administrative privileges could retrieve sensitive
information including passwords; SNMP responses that contain AuthSecret
and PrivSecret after collecting a “supportsave” or getting access to an
already collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952

Affected products

VendorProductAffectedFixed
Brocade Brocade SANnav before 2.3.1b —

Advisories 1

References