PT-2024-23170 · Brocade · Brocade Sannav

Pierre Barre · Published 2024-04-19 · Updated 2025-02-04 · CVE-2024-29961

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a

Description The issue allows a Brocade SANnav service to send ping commands in the background at regular intervals to gridgain.com to check if updates are available for the Component. This could make an unauthenticated, remote attacker aware of the behavior and launch a supply-chain attack against a Brocade SANnav appliance.

Recommendations For Brocade SANnav versions prior to 2.3.1, update to version 2.3.1 or later. For Brocade SANnav version 2.3.0a, update to version 2.3.1 or later. As a temporary workaround, consider disabling the update check feature that sends ping commands to gridgain.com until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-29961

Affected Products

Brocade Sannav

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-29961 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29961 · Vendor Advisory
• https://support.broadcom.com/external/content/SecurityAdvisories/0/23246 · Vendor Advisory
• https://t.me/true_secator/5687 · Telegram Post
• https://t.me/cvenotify/77393 · Telegram Post
• https://twitter.com/XynikIT/status/1783879431821341007 · Twitter Post
• https://t.me/cvenotify/109865 · Telegram Post