Fabric OS Vulnerability Allows for Password Capture in Firmware Downloads

CVE-2024-10403

What is CVE-2024-10403?

A vulnerability in certain versions of Brocade Fabric OS allows the SFTP/FTP server password used during firmware download operations to be captured. This occurs when the operation is initiated by the SANnav management interface or through WebEM, and is then recorded in a core dump. Such core dumps can be collected via the supportsave feature, posing risks to the confidentiality of sensitive credentials. This vulnerability highlights critical risks associated with improper handling of server passwords, particularly in a storage area network environment.

References