Cleartext storage of sensitive information in Brocade SANnav - CVE-2023-31925
Published: May 21, 2025
Vulnerability identifier: #VU109607
CSH Severity: High
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-31925
CWE-ID: CWE-312
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to Brocade SANnav stores SNMPv3 Authentication passwords in plaintext. A remote user could retrieve these credentials with knowledge and access to these log files. SNMP credentials could be seen in SANnav SupportSave if the capture is performed after an SNMP configuration failure causes an SNMP communication log dump.
Affected software
Brocade SANnav
How to mitigate CVE-2023-31925
Install updates from vendor's website.
Brocade SANnav - addressed in versions 2.2.2a, 2.3.0