PT-2024-5073 · Brocade · Brocade Sannav

Published 2024-04-17 · Updated 2024-04-19 · CVE-2024-29969

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions 2.2.2 through 2.3.0

Description: The issue is related to insufficient reliability of encryption in the TLS/SSL component of the Brocade SANnav network management software. This can allow a remote attacker to perform a "man-in-the-middle" attack and gain unauthorized access to protected information. When upgrading from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, weak message authentication code ciphers are added by default for port 18082.

Recommendations: For Brocade SANnav versions 2.2.2 through 2.3.0, consider disabling the use of weak message authentication code ciphers for port 18082 as a temporary workaround until a patch is available. Restrict access to port 18082 to minimize the risk of exploitation. Avoid using weak TLS/SSL ciphers in the affected Brocade SANnav installations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BDU:2024-05600

CVE-2024-29969

Affected Products

Brocade Sannav

References · 6

• https://osv.dev/vulnerability/CVE-2024-29969 · Vendor Advisory
• https://support.broadcom.com/external/content/SecurityAdvisories/0/23251 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05600 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-29969 · Security Note
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23251 · Note
• https://t.me/cvenotify/77402 · Telegram Post