The vulnerability is a flaw in the job scheduling component of SANnav that causes sensitive credentials to be written to application logs in clear text. When support save jobs or operations are performed, parameters such as external server passwords and archive protection keys are logged without masking. This results in the potential exposure of credentials that an attacker may use to gain unauthorized access to remote backup targets or protected archives.

The affected product is Brocade SANnav before version 3.0.1a. Users deploying these versions are at risk if they have local or authenticated access to the application logs or support bundles.

The CVSS score of 6.9 indicates a moderate severity. EPSS information is unavailable, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a local or authenticated user who can read application logs; if such access is granted, they can directly retrieve the exposed credentials. Once credentials are compromised, the attacker may establish unauthorized connections to remote backup systems or retrieve protected archives. Due to the lack of a remote exploit mechanism, the risk is primarily confined to systems with privileged log access.