CVE-2024-29960

April 19, 2024, 1:10 p.m.

7.5
High

Description

In the Brocade SANnav server versions before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are hardcoded and identical in the VM every time SANnav is installed. Any Brocade SANnav VM based on the official OVA images is vulnerable to MITM over SSH. An attacker can decrypt and compromise the SSH traffic to the SANnav appliance.

Product(s) Impacted

Product Versions
Brocade SANnav server
  • ['before v2.3.1', 'v2.3.0a']

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/23244

Tags

CVSS Score

7.5 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

    View Vector String

Timeline

Published: April 19, 2024, 4:15 a.m.
Last Modified: April 19, 2024, 1:10 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

sirt@brocade.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.