Vulnerability · Published Apr 19, 2024 · Assigned by brocade

CVE-2024-29961supply-chain attack risk

High 8.2

In plain English

A high-severity information exposure in Brocade SANnav from Brocade. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.8%top 44.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability affects Brocade SANnav before v2.3.1 and v2.3.0a. It allows a Brocade SANnav service to send ping commands in the background at regular intervals to gridgain.com to check if updates are available for the Component. This could make an unauthenticated, remote attacker aware of the behavior and launch a supply-chain attack against a Brocade SANnav appliance.

Affected products (as reported)

Vendor	Product	Versions
Brocade	Brocade SANnav	before v2.3.1 and v2.3.0a

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/23246