High severity · published Feb 14, 2025
CVE-2024-5462
Brocade Fabric OS may capture SNMP Passwords in clear text
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be exposed in plaintext. The plaintext passwords can be exposed in a configupload capture or a supportsave capture if encryption of passwords is not enabled. An attacker can use these passwords to fetch values of the supported OIDs via SNMPv3 queries. There are also a limited number of MIB objects that can be modified.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Brocade Fabric OS · Brocade
before Fabric OS 9.2.0 · source: vendor
FO
Fabric Operating System · Broadcom
before 9.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5462
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5462
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24610
More from Brocade Fabric OS
8.0
CVE-2024-5461
Command or parameter injection via unique embedded switch SNMP commands.
5.5
CVE-2021-27798
privileged directory transversal.in Brocade Fabric OS versions 7.4.1.x and 7.3.x