CVE-2024-10403

SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav

State: Published
Severity: 5.9 Medium
Published: Nov 21, 2024
Updated: Nov 21, 2024
Reserved: Oct 25, 2024

Description

Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core dump that is later captured via supportsave.

Scores

CVSS	Score	Vector	Source
4.0	5.9 Medium	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	brocade

Weaknesses

CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere

Affected Products

Product	Versions
Fabric OSBrocade	Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1aAffected

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25145

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.