CVE-2025-12680
Cleartext Password Exposure in Brocade SANnav Logs Post-Failover
Publication date: 2026-02-02
Last updated on: 2026-03-03
Assigner: Brocade Communications Systems, LLC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| broadcom | sannav | to 2.4.0b (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
| CWE-256 | The product stores a password in plaintext within resources such as memory or files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in Brocade SANnav versions before 2.4.0b, where the system logs database passwords in clear text on the standby SANnav server after a disaster recovery failover. A remote authenticated attacker with administrative privileges could access these logs or the supportsave files to read the database password.
How can this vulnerability impact me? :
The vulnerability could allow a remote authenticated attacker with admin privileges to obtain database passwords by accessing SANnav logs or supportsave files. This could lead to unauthorized access to the database, potentially compromising sensitive data and system integrity.