Brocade SANnav Vulnerability Exposes PBE Key in System Audit Logs

CVE-2025-12679

What is CVE-2025-12679?

A security flaw exists in Brocade SANnav versions prior to 2.4.0b, where the Password-Based Encryption (PBE) key is inadvertently printed in plaintext within the system audit logs. This vulnerability can be exploited by a remote authenticated attacker who has access to these logs, allowing them to retrieve sensitive encryption keys. It is important to note that this issue only arises during a migration process and is not present in new installations. Access to the audit logs is restricted to privileged users, namely the server administrators, and such logs are not visible to any SANnav admin or user.

References