CVE-2025-12680 MEDIUM

CVE-2025-12680: Brocade SANnav DataBase plaintext password is logged in failover logs (CVE-2025-12680)

Vendor Brocade
Product SANnav
Weakness CWE-256
Published February 2, 2026
Last update February 3, 2026
View on NVD All CVEs

CVSS base score

6.0/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover. The vulnerability could allow a remote authenticated attacker with admin privilege able to access the SANnav logs or the supportsave to read the database password.

Key dates

02Disclosure timeline

February 2, 2026 CVE published
February 3, 2026 Record updated