PT-2022-3072 · Brocade · Brocade Sannav

Published 2022-06-22 · Updated 2023-08-08 · CVE-2022-28166

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 2.1.1.8 Brocade SANnav versions prior to SANN2.2.0.2

Description The issue is related to the implementation of TLS/SSL Server in the Brocade SANnav software, which supports the use of static key ciphers on ports 443 and 18082. This could allow a remote attacker to elevate their privileges.

Recommendations For Brocade SANnav versions prior to 2.1.1.8, update to version 2.1.1.8 or later. For Brocade SANnav versions prior to SANN2.2.0.2, update to version SANN2.2.0.2 or later. As a temporary workaround, consider disabling the use of static key ciphers on ports 443 and 18082 until a patch is available.

Fix

Use of a Broken Cryptographic Algorithm

Using Hardcoded Credentials

Weakness Enumeration

CWE-327

CWE-798

Related Identifiers

BDU:2022-03742

CVE-2022-28166

Affected Products

Brocade Sannav

References · 8

• https://broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1977 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03742 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28166 · Security Note
• https://t.me/true_secator/3121 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220627-0001 · Note
• https://t.me/cibsecurity/45220 · Telegram Post
• https://t.me/cvenotify/32250 · Telegram Post