PT-2024-3488 · Brocade · Brocade Sannav

Pierre Barre · Published 2024-04-16 · Updated 2025-09-02 · CVE-2024-2859

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions (affected versions not specified)

Description The issue is related to inadequate access control in the software, which could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. By default, SANnav OVA is shipped with the root user login enabled, although it is protected by a password. If an attacker gains access to the root account, they could expose SANnav to remote attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Incorrect Default Permissions

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-276

CWE-269

Related Identifiers

BDU:2024-03790

CVE-2024-2859

Affected Products

Brocade Sannav

References · 14

• https://support.broadcom.com/external/content/SecurityAdvisories/0/23245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2859 · Security Note
• https://bdu.fstec.ru/vul/2024-03790 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2859 · Vendor Advisory
• https://t.me/true_secator/5687 · Telegram Post
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23245 · Note
• https://twitter.com/CVEnew/status/1784040274274255291 · Twitter Post
• https://twitter.com/linuxpatch/status/1784026158570279143 · Twitter Post
• https://t.me/cveNotify/134114 · Telegram Post
• https://t.me/cvenotify/112065 · Telegram Post
• https://t.me/cvenotify/84793 · Telegram Post
• https://t.me/cvenotify/78233 · Telegram Post
• https://twitter.com/XynikIT/status/1783879431821341007 · Twitter Post
• https://security.netapp.com/advisory/ntap-20240628-0003 · Note