Medium severity · published Feb 14, 2025
CVE-2024-10404
Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave
4.4
CVSS
0.1%
EPSS
No
On KEV
Description
CalInvocationHandler in Brocade
SANnav before 2.3.1b logs sensitive information in clear text. The
vulnerability could allow an authenticated, local attacker to view
Brocade Fabric OS switch sensitive information in clear text. An
attacker with administrative privileges could retrieve sensitive
information including passwords; SNMP responses that contain AuthSecret
and PrivSecret after collecting a “supportsave” or getting access to an
already collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Brocade SANnav · Brocade
before 2.3.1b · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10404
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25403
More from Brocade SANnav
9.8
CVE-2024-4282
Weak TLS Ciphers on Brocade SANnav OVA SSH port 22
9.8
CVE-2024-4173
SANnav versions exposes Kafka in the wan interface.
9.8
CVE-2024-29966
hard-coded credentials in the documentation that appear as the appliance root password
8.6
CVE-2024-29959
Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save
8.2
CVE-2024-29961
supply-chain attack risk