Medium severity · published Apr 19, 2024
CVE-2024-29965
Insecure backup
5.9
CVSS
0.4%
EPSS
No
On KEV
Description
In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The resulting backups are world-readable. A local attacker can recover backup files, restore them to a new malicious appliance, and retrieve the passwords of all the switches.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Brocade SANnav · Brocade
before v2.3.1, and v2.3.0a · source: vendor, NVD
SA
Sannav · Brocade
before 2.3.0a · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-29965
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-29965
Vendor Advisory
https://support.broadcom.com/external/content/SecurityAdvisories/0/23250
More from Brocade SANnav
9.8
CVE-2024-4282
Weak TLS Ciphers on Brocade SANnav OVA SSH port 22
9.8
CVE-2024-4173
SANnav versions exposes Kafka in the wan interface.
9.8
CVE-2024-29966
hard-coded credentials in the documentation that appear as the appliance root password
8.6
CVE-2024-29959
Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save
8.2
CVE-2024-29961
supply-chain attack risk