PT-2024-3104 · Brocade · Brocade Sannav

Published 2024-04-25 · Updated 2024-04-25 · CVE-2024-4173

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brocade SANnav (affected versions not specified)

Description A vulnerability in Brocade SANnav exposes Kafka in the wan interface, allowing an unauthenticated attacker to perform various attacks, including DOS against the Brocade SANnav. The issue is also related to the presence of an undocumented user sannav, which could allow an attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Hidden Functionality

Information Disclosure

Using Hardcoded Credentials

Weakness Enumeration

CWE-912

CWE-200

CWE-798

Related Identifiers

BDU:2024-03305

CVE-2024-4173

Affected Products

Brocade Sannav

References · 7

• https://bdu.fstec.ru/vul/2024-03305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-4173 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4173 · Vendor Advisory
• https://support.broadcom.com/external/content/SecurityAdvisories/0/23285 · Note
• https://t.me/cvenotify/78060 · Telegram Post
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23285 · Note
• https://t.me/cvenotify/77980 · Telegram Post