CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4282 – Weak TLS Ciphers on Brocade SANnav OVA SSH port 22
https://notcve.org/view.php?id=CVE-2024-4282
14 Feb 2025 — Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22. • https://support.broadcom.com/external/content/SecurityAdvisories/0/25400 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-10405 – Weak TLS Ciphers on Brocade SANnav port 443 & 18082
https://notcve.org/view.php?id=CVE-2024-10405
14 Feb 2025 — Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit, an attacker can read Brocade SANnav data stream that includes monitored Brocade Fabric OS switches performance data, port status, zoning information, WWNs, IP Addresses, but no customer data, no personal data and no secrets or passwords, as it travels across the network. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25402 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2240 – Docker implementation in Brocade SANnav is missing Audit Rules.
https://notcve.org/view.php?id=CVE-2024-2240
14 Feb 2025 — Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25401 • CWE-250: Execution with Unnecessary Privileges •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1053 – Brocade SANnav encryption key is logged in the debug logs
https://notcve.org/view.php?id=CVE-2025-1053
14 Feb 2025 — Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANnav. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25399 • CWE-1295: Debug Messages Revealing Unnecessary Information •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-10404 – Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave
https://notcve.org/view.php?id=CVE-2024-10404
14 Feb 2025 — CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive information including passwords; SNMP responses that contain AuthSecret and PrivSecret after collecting a “supportsave” or getting access to an already collected “supportsave”. NOTE: this issue exists because of an i... • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25403 • CWE-312: Cleartext Storage of Sensitive Information •