CVE-2025-12680— Brocade SANnav DataBase plaintext password is logged in failover logs (CVE-2025-12680)
Quick assessment
Affected
Brocade SANnav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Brocade SANnav是美国Brocade公司的一个存储区域网络管理软件。 Brocade SANnav 2.4.0b之前版本存在安全漏洞，该漏洞源于在备用SANnav服务器的灾难恢复故障转移后以明文记录数据库密码，可能导致远程经过身份验证且具有管理员权限的攻击者读取数据库密码。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-12680
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Brocade SANnav DataBase plaintext password is logged in failover logs (CVE-2025-12680)
Source: CVE Program / CVE List V5
Vulnerability Description
Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover. The vulnerability could allow a remote authenticated attacker with admin privilege able to access the SANnav logs or the supportsave to read the database password.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
明文存储口令
Source: CVE Program / CVE List V5
Vulnerability Title
Brocade SANnav 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Brocade SANnav是美国Brocade公司的一个存储区域网络管理软件。 Brocade SANnav 2.4.0b之前版本存在安全漏洞，该漏洞源于在备用SANnav服务器的灾难恢复故障转移后以明文记录数据库密码，可能导致远程经过身份验证且具有管理员权限的攻击者读取数据库密码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-12680
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-12680
请登录查看更多情报信息。
Same Patch Batch · Brocade · 2026-02-02 · 3 CVEs total
| CVE-2025-12772 | Plaintext Switch admin login password is seen in Brocade SANnav support save | |
| CVE-2025-12679 | Plain text pbe key visible in audit log during Brocade SANnav migration from 2.4.0a to 3.0 |
IV. Related Vulnerabilities
Same product: SANnav
-
CVE-2026-85417
Incomplete property masking in the SANnav logging subsystem -
CVE-2026-14441
Logic flaw in SANnav Java cache key handling object comparis -
CVE-2026-14442
Information exposure vulnerability in the job scheduling com -
CVE-2026-14443
Incomplete log sanitization during bulk IPsec policy collect -
CVE-2026-82372
Improper handling of sensitive data during IPsec policy crea
Same vendor: Brocade
-
CVE-2026-85417
Incomplete property masking in the SANnav logging subsystem -
CVE-2026-14441
Logic flaw in SANnav Java cache key handling object comparis -
CVE-2026-14442
Information exposure vulnerability in the job scheduling com -
CVE-2026-14443
Incomplete log sanitization during bulk IPsec policy collect -
CVE-2026-82372
Improper handling of sensitive data during IPsec policy crea
Same weakness: CWE-256
-
CVE-2026-84884
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-2380
Security Advisory 0168 -
CVE-2026-46488
motionEye: Authentication possible via password hash -
CVE-2026-82783
Contec CONPROSYS nano Series 信任管理问题漏洞 -
CVE-2026-19051
Plaintext Storage of User Credentials in Menulux Software's
V. Comments for CVE-2025-12680
No comments yet