A local user who has access to the Brocade ASCG virtual machine can issue a request to the SANnav host network namespace and, without authorization, extract the stored management credentials for onboarded SANnav instances. These credentials provide full control over the connected Brocade SANnav servers or managed Fibre Channel switches, allowing an attacker to alter configuration, read sensitive data, or disrupt services. The weakness is a failure to adequately protect stored credentials, as defined by CWE‑522, and it directly impacts confidentiality and integrity across the SAN ecosystem.

The vulnerability exists in Brocade Active Support Connectivity Gateway versions prior to 3.5.0. Any deployment of the ASCG appliance running one of these versions is susceptible; this includes all localized installations that provide the SANnav host network namespace functionality.

The CVSS score of 8.4 indicates high severity. While the EPSS score is not available, the lack of a KEV listing does not diminish the risk because the flaw enables credential extraction with local VM access. The attack vector is inferred as local; a user who can log into the ASCG VM or otherwise reach the SANnav namespace can exploit the flaw.