Cleartext Password Exposure in Brocade SANnav Logs Post-Failover

Publication date: 2026-02-02

Last updated on: 2026-03-03

Assigner: Brocade Communications Systems, LLC

Description

Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover. The vulnerability could allow a remote authenticated attacker with admin privilege able to access the SANnav logs or the supportsave to read the database password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-02

Last Modified

2026-03-03

Generated

2026-07-06

AI Q&A

2026-02-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12680

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	sannav	to 2.4.0b (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-256	The product stores a password in plaintext within resources such as memory or files.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in Brocade SANnav versions before 2.4.0b, where the system logs database passwords in clear text on the standby SANnav server after a disaster recovery failover. A remote authenticated attacker with administrative privileges could access these logs or the supportsave files to read the database password.

Impact Analysis

The vulnerability could allow a remote authenticated attacker with admin privileges to obtain database passwords by accessing SANnav logs or supportsave files. This could lead to unauthorized access to the database, potentially compromising sensitive data and system integrity.

Hi! I’m here to help you understand CVE-2025-12680. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70