What’s Vulnerable › Vulnerabilities
CVE-2025-12680: Brocade SANnav DataBase plaintext password is logged in failover logs (CVE-2025-12680)
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-02 · updated 2026-06-17
- Weakness: CWE-256
Description
Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover. The vulnerability could allow a remote authenticated attacker with admin privilege able to access the SANnav logs or the supportsave to read the database password.
Affected products
- Brocade SANnav: before 2.4.0b — fixed in 2.4.0b
How to fix
Upgrade to a fixed version: Brocade SANnav 2.4.0b. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-12680 or the next vulnerability affects your stack