firmwaredownload command could log servers passwords in clear text
CVE-2023-3489

7.5HIGH

Key Information:

Vendor

Brocade
Status
Fabric Os
Vendor
CVE Published:
31 August 2023

What is CVE-2023-3489?

A vulnerability in Brocade Fabric OS v9.2.0 allows the firmwaredownload command to log FTP, SFTP, and SCP server passwords in clear text within the SupportSave file during the downgrade process to earlier versions. This could lead to potential unauthorized access as sensitive credentials are exposed in an accessible format, posing a significant risk to system security.

Affected Version(s)

Fabric OS Director Brocade Fabric OS v9.2.0

References

https://support.broadcom.com/web/ecx/support-content-noti...
https://security.netapp.com/advisory/ntap-20231124-0003/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.