CVE-2024-5462
Published: 15 February 2025
Summary
CVE-2024-5462 is a high-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Broadcom Fabric Operating System. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SC-28 (Protection of Information at Rest).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires establishing and enforcing configuration settings to encrypt SNMP passwords, directly preventing plaintext exposure in configupload and supportsave captures.
Mandates timely flaw remediation including upgrading to Fabric OS 9.2.0 or later, which fixes the vulnerability causing plaintext SNMP credential exposure.
Implements safeguards to protect sensitive information at rest, such as SNMP passwords in configupload and supportsave files, from unauthorized disclosure.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct exposure of SNMP credentials in plaintext within config/support capture files (CWE-319) maps to unsecured credentials stored in files.
NVD Description
If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be exposed in plaintext. The plaintext passwords can be exposed in a configupload capture or…
more
a supportsave capture if encryption of passwords is not enabled. An attacker can use these passwords to fetch values of the supported OIDs via SNMPv3 queries. There are also a limited number of MIB objects that can be modified.
Deeper analysisAI
CVE-2024-5462 affects Brocade Fabric OS versions prior to 9.2.0. The vulnerability arises when configuration settings are not enabled to encrypt SNMP passwords, causing the SNMP privsecret and authsecret fields to be exposed in plaintext within configupload captures or supportsave captures. This issue is classified under CWE-319 (Cleartext Transmission of Sensitive Information) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact from a network-accessible attack with low complexity and no privileges required.
An attacker who obtains access to an unencrypted configupload or supportsave capture can extract the plaintext SNMP passwords. With these credentials, the attacker can perform SNMPv3 queries to retrieve values of supported OIDs and modify a limited number of MIB objects, potentially enabling unauthorized monitoring or configuration changes on the affected Fabric OS device.
The Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24610 provides details on mitigation. Administrators should upgrade to Fabric OS 9.2.0 or later and ensure SNMP password encryption is explicitly enabled in configuration settings to prevent plaintext exposure in captures.
Details
- CWE(s)