CVE-2024-29960 Vulnerability Details

  /     /     /  

CVE-2024-29960 Metadata Quick Info

CVE Published: 19/04/2024 | CVE Updated: 02/08/2024 | CVE Year: 2024
Source: brocade | Vendor: Brocade | Product: Brocade SANnav
Status : PUBLISHED

CVE-2024-29960 Description

In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnnav VM based on the official OVA images is vulnerable to MITM over SSH. An attacker can decrypt and compromise the SSH traffic to the SANnav.

Metrics

CVSS Version: 3.1 | Base Score: 6.8 MEDIUM
Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* ADJACENT_NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* HIGH
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-798
CWE Name: CWE-798 Use of Hard-coded Credentials
Source: Brocade

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-70
CAPEC Description: CAPEC-70 Try Common or Default Usernames and Passwords


Source: NVD (National Vulnerability Database).