PT-2025-29167 · Brocade · Brocade Sannav

Published 2025-07-08 · Updated 2025-08-27 · CVE-2025-6392

Positive Technologies (AI Summary)

CVSS v4.0

6.7

Medium

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.4.0a

Description: Brocade SANnav versions prior to 2.4.0a could log database passwords in clear text within audit logs when the daily data dump collector executes docker exec commands. These audit logs are local to the server VM and are not managed by SANnav. Access to these logs is restricted to the host server administrator and is not accessible to SANnav administrators or users.

Recommendations: Update Brocade SANnav to version 2.4.0a or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2025-09916

CVE-2025-6392

Affected Products

Brocade Sannav

References · 7

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35910 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09916 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6392 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6392 · Security Note
• https://twitter.com/VulmonFeeds/status/1943586891976061349 · Twitter Post
• https://twitter.com/CVEnew/status/1943668180297433543 · Twitter Post
• https://t.me/cveNotify/133733 · Telegram Post