Vulnerability · Published Feb 14, 2025 · Assigned by brocade
CVE-2024-10404Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave
Medium 5.5
In plain English
A medium-severity security flaw in Brocade SANnav from Brocade. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive information including passwords; SNMP responses that contain AuthSecret and PrivSecret after collecting a “supportsave” or getting access to an already collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Brocade | Brocade SANnav | before 2.3.1b |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N