Medium severity · published Jul 10, 2025
CVE-2025-6392
Daily Data Dump Collector logs database password in cleartext when running docker exec commands (CVE-2025-6392)
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
Brocade SANnav before Brocade SANnav 2.4.0a could log database passwords in clear text in audit logs when the daily data dump collector invokes docker exec commands. These audit logs are the local server VM’s audit logs and are not controlled by SANnav. These logs are only visible to the server admin of the host server and are not visible to the SANnav admin or any SANnav user.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Brocade SANnav · Broadcom
Brocade SANnav versions before 2.4.0a · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6392
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6392
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35910
More from Brocade SANnav
9.8
CVE-2024-4282
Weak TLS Ciphers on Brocade SANnav OVA SSH port 22
9.8
CVE-2024-4173
SANnav versions exposes Kafka in the wan interface.
9.8
CVE-2024-29966
hard-coded credentials in the documentation that appear as the appliance root password
9.8
CVE-2023-31424
Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout