CVE-2024-2240
Published: 14 February 2025
Summary
CVE-2024-2240 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Broadcom Brocade Sannav. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 22.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AU-12 (Audit Record Generation) and AU-2 (Event Logging).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires generation of audit records for defined events in system components like the Docker daemon, addressing the core vulnerability of running without auditing.
Mandates logging of key events such as privileged operations in the Docker daemon, enabling detection of attacks that would otherwise go unlogged.
Requires review and analysis of audit records to identify inappropriate activities performed through the unaudited Docker daemon.
NVD Description
Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks.
Deeper analysisAI
CVE-2024-2240 affects the Docker daemon in Brocade SANnav versions prior to 2.3.1b, where it runs without auditing enabled. This misconfiguration, mapped to CWE-250 (Execution with Unnecessary Privileges), exposes the system to potential abuse by allowing actions to go unlogged and undetected. The vulnerability has a CVSS v3.1 base score of 7.2 (High), with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impacts on confidentiality, integrity, and availability.
A remote authenticated attacker with high privileges (PR:H) can exploit this vulnerability to execute various attacks on the SANnav system. The lack of auditing in the Docker daemon enables attackers to perform unauthorized operations without generating logs, facilitating stealthy compromise of the storage area network management platform while evading detection.
Mitigation is addressed in the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25401, which recommends upgrading to SANnav 2.3.1b or later to enable proper auditing in the Docker daemon.
Details
- CWE(s)