An attacker who can read system or support bundle log files can obtain both administrative switch credentials and active session tokens because the discovery service logs store them in cleartext. The availability of these secrets enables compromise of the managed network infrastructure, allowing the attacker to access or impersonate the application’s active sessions. This represents a serious confidentiality and integrity breach for any organization using Brocade SANnav.

Brocade SANnav versions prior to 3.0.1a contain this weakness. The vulnerability is identified only in the SANnav product line and does not affect other Brocade solutions.

The CVSS score of 8.5 shows a high severity, and the EPSS score is not available, so the likelihood of exploitation remains unclear. The vulnerability is not listed in the CISA KEV catalog. An attacker must first gain read access to the log files, which can occur through local privileges or by retrieving support bundles that contain the logs. Once an attacker has these files, extracting the plaintext credentials is trivial, and they can use them to authenticate to the switch or hijack existing sessions. This makes the flaw highly exploitable for anyone with sufficient file access.