Identical SSH keys utilized inside the OVA image (CVE-2024-29960)

2024-04-1700:00:00

Broadcom Security Response

support.broadcom.com

brocade sannav

ova image

ssh keys

mitm

compromise

vulnerability

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnnav VM based on the official OVA images is vulnerable to MITM over SSH. An attacker can decrypt and compromise the SSH traffic to the SANnav.

Affected configurations

Vulners

Node

broadcombrocade_sannavRange<2.3.0a

CPENameOperatorVersion
brocade sannavlt2.3.0a

CPE	Name	Operator	Version
	brocade sannav	lt	2.3.0a