← Vulnerability feed

Vulnerability record · CVE-2024-29966 · published 19 April 2024

CVE-2024-29966: Broadcom brocade sannav hard-coded credentials vulnerability

Broadcom · Brocade Sannav

Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appliance.

9.8 CVSS 3.1 Critical EPSS 0.65% · top 50.9% CWE-798 · Hard-coded credentials
9.8CVSS 3.1 base score
0.65%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appliance.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.broadcom.com/external/content/SecurityAdvisories/0/23255 Vendor Advisory
https://support.broadcom.com/external/content/SecurityAdvisories/0/23255 Vendor Advisory

Track CVE-2024-29966 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-4173Broadcom brocade sannav information exposure vulnerabilityA vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform various at…EPSS 0.59%9.8CVE-2023-31424Broadcom brocade sannav authentication bypass by spoofing vulnerabilityBrocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorizat…EPSS 0.90%9.8CVE-2022-23305Log4j 1.x JDBCAppender SQL injection via logged inputThe JDBCAppender in Log4j 1.2.x builds SQL statements from configuration parameters and PatternLayout converters, so logged values such as the %m mes…EPSS 67%analysed9.8CVE-2019-16211Broadcom brocade sannav insufficiently protected credentials vulnerabilityBrocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.EPSS 1.0%9.0CVE-2024-3596Freeradius vulnerabilityRADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject,…EPSS 15%8.8CVE-2022-23302Apache Log4j 1.x JMSSink JNDI deserialization remote code executionJMSSink in all versions of Log4j 1.x deserializes untrusted data when an attacker can write to the Log4j configuration or when the configuration refe…EPSS 64%analysed8.8CVE-2019-16212Broadcom brocade sannav vulnerabilityA vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulnerability …EPSS 1.9%8.8CVE-2019-16205Broadcom brocade sannav vulnerabilityA vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to …EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2024-29966), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.