CVE-2024-29960CWE-798

Identical SSH keys utilized inside the OVA image (CVE-2024-29960)

Medium · published April 19, 2024

CVSS v3.1
6.8
EPSS
0%
Percentile
22.6
In the wild
Unconfirmed
What it is

In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnnav VM based on the official OVA images is vulnerable to MITM over SSH. An attacker can decrypt and compromise the SSH traffic to the SANnav.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00310 · 22.6th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-04-19T03:30Z
EPSS history
Timeline
  • 19 APR 03:30Z
    Identical SSH keys utilized inside the OVA image (CVE-2024-29960)
    cvelistv5