CVE-2025-12773
Sensitive Information Exposure in Brocade SANnav Script Logging
Publication date: 2026-02-03
Last updated on: 2026-03-03
Assigner: Brocade Communications Systems, LLC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| broadcom | sannav | to 2.4.0a (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-209 | The product generates an error message that includes sensitive information about its environment, users, or associated data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the update-reports-purge-settings.sh script logging for Brocade SANnav versions before 2.4.0a. It could cause the SANnav database password to be recorded in the system audit logs. A remote authenticated attacker who can access these audit logs could then obtain the database password.
How can this vulnerability impact me? :
The vulnerability could allow a remote authenticated attacker with access to the audit logs to retrieve the Brocade SANnav database password. This could lead to unauthorized access to the SANnav database, potentially compromising sensitive data or system integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves the logging of the SANnav database password in system audit logs, which could be accessed by a remote authenticated attacker. Exposure of sensitive credentials in logs can lead to unauthorized access to protected data.
Such exposure may impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive information and proper access controls to prevent unauthorized disclosure.
Therefore, this vulnerability could lead to non-compliance with these regulations due to inadequate protection of sensitive credentials and potential unauthorized access.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know