CVE-2025-1053

Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANna...

CVE-2024-10404

CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive...

CVE-2025-1053 Brocade SANnav encryption key is logged in the debug logs

Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANna...

CVE-2025-1053

CVE-2025-1053 affects Brocade SANnav. Under certain error conditions during installation or upgrade, the encryption key can be written to and retrieved from a SANnav supportsave. An attacker with privileged access to the SANnav database could use that key to obtain passwords used by SANnav. Conne...

CVE-2025-1053 Brocade SANnav encryption key is logged in the debug logs

Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANna...

CVE-2024-10404

CVE-2024-10404 affects Brocade SANnav (before 2.3.1b). It discloses that CalInvocationHandler logs sensitive information in clear text, allowing an authenticated, local attacker with admin privileges to view sensitive data (including passwords such as AuthSecret and PrivSecret) after a supportsav...

CVE-2024-10404 Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave

CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive...

CVE-2024-10404 Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave

CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive...

CVE-2025-1053: Insertion of Sensitive Information into Log File

Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANna...

Broadcom SANnav 安全漏洞

Broadcom SANnav is a suite of SAN management platforms from Broadcom Corporation USA. A security vulnerability exists in Broadcom SANnav that stems from CalInvocationHandler logging sensitive information in plaintext. An authenticated, local attacker could use this vulnerability to view sensitive...

CVE-2024-10404: Cleartext Storage of Sensitive Information

CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive...

PT-2025-6718

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.0 Description The issue arises when configuration settings in Brocade Fabric OS are not set to encrypt SNMP passwords, resulting in the exposure of SNMP privsecret and authsecret fields in plaintext. Thi...

CVE-2024-2240: Execution with Unnecessary Privileges

Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks...

CVE-2023-5973

Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display...

CVE-2023-3489

The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS...

CVE-2023-3454

Remote code execution RCE vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to the Brocade switch...

CVE-2023-31431

A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crash the Brocade Fabric OS switch leading to a denial of service...

CVE-2023-31423

Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav before v2.3.0 and 2.2.2a. Notes: To access the logs, the local attacker must have access to an already collected Brocade SANnav "supportsave"...

CVE-2023-31432

Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0...

CVE-2023-31427

Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0, “root” account access is disabled...