What’s Vulnerable › Vulnerabilities
CVE-2024-10403: SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-11-21 · updated 2026-06-17
- Weakness: CWE-528
Description
Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core dump that is later captured via supportsave.
Affected products
- Brocade Fabric OS: before 9.2.0c1; from 9.2.1 before 9.2.1a1 — fixed in 9.2.0c1, 9.2.1a1
How to fix
Upgrade to a fixed version: Brocade Fabric OS 9.2.0c1, 9.2.1a1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-10403 or the next vulnerability affects your stack