Incomplete Property Masking in SANnav Logs Exposes SNMP Credentials

Executive Summary

This vulnerability involves incomplete property masking in the SANnav logging subsystem. Under specific configuration conditions, SNMP authentication and privacy passwords are recorded in application logs. This allows individuals with read access to system logs or support bundles to retrieve these credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves SNMP authentication and privacy passwords being logged in plaintext under specific SANnav logging conditions. To detect it, inspect SANnav application logs and support bundles for exposed SNMP credentials. Search for log entries containing SNMP-related keywords like 'authentication', 'privacy', or 'password' in plaintext.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could lead to unauthorized read or management access to monitored switch environments. Attackers gaining access to SNMP credentials may intercept network traffic or manipulate switch configurations, disrupting operations or compromising data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements by exposing sensitive credentials in logs. GDPR could be impacted due to unauthorized access to personal data, while HIPAA may be breached if protected health information is compromised through switch management access.

Useful 0 Not Useful 0

Mitigation Strategies

Disable logging of SNMP authentication and privacy passwords in SANnav logs. Review and restrict access to system logs and support bundles to authorized personnel only. Update SANnav to the latest version if a patch is available.

Useful 0 Not Useful 0