CVE-2025-12679: Brocade SANnav Information Disclosure

CVE-2025-12679 Overview

A sensitive data exposure vulnerability has been identified in Brocade SANnav versions prior to 2.4.0b. The vulnerability causes the Password-Based Encryption (PBE) key to be printed in plaintext within the system audit log file during migration operations. A remote authenticated attacker with access to the audit logs could potentially retrieve the PBE key, compromising encrypted data protected by this key.

It is important to note that this vulnerability is only triggered during migration processes and does not affect new installations. The affected system audit logs are accessible only to privileged users on the server and are managed by the host server's operating system rather than SANnav itself. These logs are only visible to the server administrator of the host server and are not accessible to SANnav administrators or regular SANnav users.

Critical Impact

Exposure of the Password-Based Encryption (PBE) key could allow an attacker to decrypt sensitive data protected by this key, potentially leading to broader system compromise and unauthorized access to encrypted credentials or configuration data.

Affected Products

• Brocade SANnav versions prior to 2.4.0b

Discovery Timeline

• 2026-02-02 - CVE CVE-2025-12679 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-12679

Vulnerability Analysis

This vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information). The core issue stems from improper handling of cryptographic key material during the migration process in Brocade SANnav. When a migration operation is performed, the system writes the Password-Based Encryption key directly to the audit log file without proper redaction or masking.

Password-Based Encryption keys are critical security assets used to protect sensitive data at rest. When such keys are exposed in plaintext, any attacker who gains read access to the log files can retrieve the key and use it to decrypt protected data. While the attack requires local access and elevated privileges, the potential impact is significant given the sensitive nature of PBE keys in storage area network management systems.

Root Cause

The root cause of this vulnerability is insufficient output sanitization during the migration logging process. The SANnav application fails to properly redact or mask sensitive cryptographic material before writing it to system audit logs. This represents a violation of secure coding practices that mandate the exclusion of secrets, credentials, and cryptographic keys from log output.

The logging mechanism does not implement appropriate filters or scrubbing routines to detect and mask PBE key values before they are persisted to the audit log file, resulting in cleartext exposure of this sensitive information.

Attack Vector

The attack vector requires local access to the system where Brocade SANnav is installed. An attacker would need to:

1. Obtain authenticated access to the host server with sufficient privileges to read system audit logs
2. Wait for or trigger a migration operation that causes the PBE key to be logged
3. Search the audit log files for the exposed PBE key material
4. Use the recovered key to decrypt any data protected by this PBE key

While the attack requires elevated privileges on the host server, it could be exploited by insider threats, compromised administrator accounts, or through privilege escalation from other vulnerabilities. The exposure persists as long as the audit logs containing the key are retained on the system.

Detection Methods for CVE-2025-12679

Indicators of Compromise

• Unexpected or unauthorized access to system audit log files on the SANnav host server
• Unusual log file access patterns, particularly around migration event timestamps
• Evidence of log file exfiltration or copying to external locations
• Unauthorized decryption attempts using recovered PBE key material

Detection Strategies

• Implement file integrity monitoring on system audit log directories to detect unauthorized access
• Monitor for anomalous read operations against audit log files by non-administrative users
• Enable audit logging for access to the audit log files themselves to create an access trail
• Review authentication logs for unusual privileged access patterns to the SANnav host server

Monitoring Recommendations

• Configure SIEM alerts for bulk log file access or unusual access patterns to audit directories
• Implement privileged access management (PAM) solutions to monitor and record all administrative access to the SANnav server
• Regularly review access control lists on audit log directories to ensure principle of least privilege
• Consider implementing log forwarding to a centralized, secured logging platform with restricted access

How to Mitigate CVE-2025-12679

Immediate Actions Required

• Upgrade Brocade SANnav to version 2.4.0b or later as soon as possible
• Review existing audit log files for potential PBE key exposure, particularly logs generated during previous migrations
• Rotate any PBE keys that may have been exposed in audit logs
• Securely delete or archive historical audit logs containing exposed key material

Patch Information

Broadcom has addressed this vulnerability in Brocade SANnav version 2.4.0b. Organizations running affected versions should upgrade to the patched version immediately. For detailed patch information and download instructions, refer to the Broadcom Security Advisory #36845.

Workarounds

• Restrict access to system audit logs to only essential administrative personnel until patching is complete
• Implement additional access controls and monitoring on the directories containing system audit logs
• Avoid performing migration operations on affected versions until the patch can be applied
• Consider temporarily relocating audit logs to a more secured, access-restricted location with enhanced monitoring