Technical impact
The vulnerability is a logic flaw in the Java cache key handling of Brocade SANnav that causes improper identifier resolution when processing specific user account structures. This problem could allow an attacker to exploit identity mismatch conditions, potentially gaining unauthorized access or causing access control failures. The weakness is a flaw in object comparison logic, identified as CWE‑1025.
Affected Systems
The affected product is Brocade SANnav. Any instance running a version prior to the security update version 3.0.1a is vulnerable. The patch provided in SANnav 3.0.1a resolves the comparison routines and ensures accurate object evaluation.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the flaw is exploitable by users who can craft requests containing particular user account structures to trigger the faulty comparison logic. The attack vector is likely by sending requests to the SANnav service with malformed or specially crafted account data. The risk is moderate, but organizations using SANnav should promptly apply the available patch.
