Brocade SANnav’s logging subsystem does not fully mask SNMP credentials, resulting in authentication and privacy passwords being written to application logs under certain configuration settings. An adversary who can read the logs or obtain a support bundle can extract these credentials, gaining unauthorized management access to monitored switch environments. The weakness is a typical information disclosure vulnerability (CWE‑532).

Systems running Brocade SANnav with the affected logging configuration. The security update addressing this flaw is available in Brocade SANnav 3.0.1a; earlier releases are potentially vulnerable if the logging settings are enabled to record SNMP credentials.

The CVSS score of 6.4 places the issue in the moderate severity range. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited publicly known exploitation. However, the vulnerability can be leveraged by anyone who gains local read access to the system logs or can procure a support bundle. Attackers might obtain the needed credentials by reading log files, escalating privileges with the recovered SNMP credentials, or by using the credentials to authenticate to the monitored switches. The likely attack vector is local or privileged access to the SANnav environment, and once credentials are exposed, remote authenticated access to the switches becomes possible.