{"id":"CVE-2024-10404","aliases":["EUVD-2025-4906","GHSA-gq57-6x2p-wrx3"],"status":"published","title":"Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave","description":"CalInvocationHandler in Brocade \nSANnav before 2.3.1b logs sensitive information in clear text. The \nvulnerability could allow an authenticated, local attacker to view \nBrocade Fabric OS switch sensitive information in clear text. An \nattacker with administrative privileges could retrieve sensitive \ninformation including passwords; SNMP responses that contain AuthSecret \nand PrivSecret after collecting a “supportsave” or getting access to an \nalready collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00109,"percentile":0.01259,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-312"],"published":"2025-02-14T03:13:19Z","modified":"2026-06-17T06:55:34Z","products":[{"vendor":"broadcom","product":"brocade_sannav"},{"vendor":"brocade","product":"brocade sannav"}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25403","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10404"},{"url":"https://github.com/advisories/GHSA-gq57-6x2p-wrx3"}],"sources":{"cve":[{"id":"CVE-2024-10404","title":"Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave","description":"CalInvocationHandler in Brocade \nSANnav before 2.3.1b logs sensitive information in clear text. The \nvulnerability could allow an authenticated, local attacker to view \nBrocade Fabric OS switch sensitive information in clear text. An \nattacker with administrative privileges could retrieve sensitive \ninformation including passwords; SNMP responses that contain AuthSecret \nand PrivSecret after collecting a “supportsave” or getting access to an \nalready collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952","status":"published","published":"2025-02-14T03:13:19.662Z","modified":"2025-02-14T15:46:28.704Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:34:02.652467Z"}],"euvd":[{"id":"EUVD-2025-4906","description":"CalInvocationHandler in Brocade \nSANnav before 2.3.1b logs sensitive information in clear text. The \nvulnerability could allow an authenticated, local attacker to view \nBrocade Fabric OS switch sensitive information in clear text. An \nattacker with administrative privileges could retrieve sensitive \ninformation including passwords; SNMP responses that contain AuthSecret \nand PrivSecret after collecting a “supportsave” or getting access to an \nalready collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952","status":"published","published":"2025-02-14T03:13:19Z","modified":"2025-02-14T15:46:28Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:30.772675Z"}],"ghsa":[{"id":"GHSA-gq57-6x2p-wrx3","title":"CalInvocationHandler in Brocade \nSANnav before 2.3.1b logs sensitive information in clear text....","description":"CalInvocationHandler in Brocade \nSANnav before 2.3.1b logs sensitive information in clear text. The \nvulnerability could allow an authenticated, local attacker to view \nBrocade Fabric OS switch sensitive information in clear text. An \nattacker with administrative privileges could retrieve sensitive \ninformation including passwords; SNMP responses that contain AuthSecret \nand PrivSecret after collecting a “supportsave” or getting access to an \nalready collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952","status":"published","published":"2025-02-14T06:30:35Z","modified":"2025-02-14T06:30:44Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:59:56.485496Z"}],"nvd":[{"id":"CVE-2024-10404","description":"CalInvocationHandler in Brocade \nSANnav before 2.3.1b logs sensitive information in clear text. The \nvulnerability could allow an authenticated, local attacker to view \nBrocade Fabric OS switch sensitive information in clear text. An \nattacker with administrative privileges could retrieve sensitive \ninformation including passwords; SNMP responses that contain AuthSecret \nand PrivSecret after collecting a “supportsave” or getting access to an \nalready collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952","status":"published","published":"2025-02-14T04:15:07.857Z","modified":"2026-06-17T06:55:34.183Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:10:44.508862Z"}]}}