VulnerabilityAnalyzed

CVE-2024-29957

This could provide attackers with an additional, less-protected path to acquiring the encryption key.

HIGH 7.5EPSS 0.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

When Brocade SANnav before v2.3.1 and v2.3.0a servers are configured in Disaster Recovery mode, the encryption key is stored in the DR log files. This could provide attackers with an additional, less-protected path to acquiring the encryption key.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-532
Affected: broadcom/brocade sannav
Source: sirt@brocade.com

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/23241Vendor Advisory
https://support.broadcom.com/external/content/SecurityAdvisories/0/23241Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.