CVE-2025-12773 HIGH

CVE-2025-12773: Plain password is generated in the audit logs while executing update-reports-purge-settings.sh script with Brocade SANnav before 2.4.0a

Vendor Brocade
Product SANnav
Weakness CWE-209 · Error message info leak
Published February 3, 2026
Last update February 3, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the collection of SANnav database password in the system audit logs. The vulnerability could allow a remote authenticated attacker with access to the audit logs to access the Brocade SANnav database password.

Key dates

02Disclosure timeline

February 3, 2026 CVE published
February 3, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-27004 OpenClaw session tool visibility hardening and Telegram webhook secret fallback CVE-2026-40997 SOAP security faults leak Spring Security account state CVE-2025-31960 HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module CVE-2026-40969 Spring gRPC AuthenticationException message reflected to remote client CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses