CVE-2024-4282
Published: 15 February 2025
Summary
CVE-2024-4282 is a high-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Broadcom Brocade Sannav. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 29.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SC-13 (Cryptographic Protection).
Deeper analysis
CVE-2024-4282 affects Brocade SANnav OVA versions prior to 2.3.1b, where a deprecated SHA1 setting is enabled for SSH on port 22. This configuration issue falls under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and has a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility (AV:N), low attack complexity (AC:L), lack of required privileges (PR:N), no user interaction (UI:N), and unchanged scope (S:U) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The vulnerability was published on 2025-02-15.
Remote, unauthenticated attackers can exploit this vulnerability over the network by targeting the weak SHA1 cryptographic setting in SSH communications on port 22. Successful exploitation could allow attackers to compromise SSH sessions, potentially leading to unauthorized access, data interception, modification, or disruption of services, aligning with the high CVSS impacts across confidentiality, integrity, and availability.
The Broadcom security advisory at https://support.broadcom.com/external/content/SecurityAdvisories/0/25400 provides details on mitigation, which includes upgrading to SANnav 2.3.1b or later to disable the deprecated SHA1 setting for SSH.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32832
Vulnerability details
Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Weak/deprecated SHA1 in public SSH directly enables MITM attacks on sessions (T1557) and unauthorized remote access via the SSH service (T1021.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-13 mandates the use of approved cryptographic mechanisms, directly prohibiting deprecated SHA1 in SSH communications to protect confidentiality and integrity.
CM-6 requires secure configuration settings for system components, ensuring the SSH service disables weak SHA1 algorithms as per vendor guidance.
SC-8 protects the confidentiality and integrity of transmitted information over SSH, mitigating risks from SHA1's cryptographic weaknesses.