Brocade SANnav Logs IPsec Pre-Shared Keys, Exposing Tunnel Credentials

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the potential exposure of keys used to secure network tunnels.

• Brocade SANnav: the vendor advisory identifies releases before 3.0.1a as affected.
• Brocade SANnav OVA: the advisory also lists this product as affected with the same before 3.0.1a boundary.
• The supplied structured record separately represents an affected range below 3.0.1 and records a status change at 3.0.1. Because that boundary differs from the advisory's 3.0.1a statement, 3.0.1 alone should not be assumed to be fully fixed; confirm the exact build with Broadcom.
• Brocade Fabric OS and Brocade ASCG are listed as not affected because the relevant component is not present.

The affected component is SANnav IPSEC, where the issue occurs during IPsec policy creation or modification. A pre-shared key supplied during that operation can be written to an application log instead of being kept out of log output. Anyone with read access to system logs or support bundles can retrieve the recorded credential. This is CWE-532, the insertion of sensitive information into a log file. The available evidence does not identify the exact log file, required logging level, record format, or whether previously created logs and support bundles are automatically scrubbed.

The supplied assessment characterizes the attack as adjacent, low complexity, requiring low privileges and no user interaction. The immediate access condition is read access to system log files or support bundles. The supplied record does not document a public exploit or observed exploitation, but that limited record should not be treated as proof that exploitation has not occurred elsewhere. Practical exploitation depends on the key being recorded, remaining valid, and the relevant logs or bundles being readable or shared with an unauthorized party.

The issue exposes pre-shared keys, directly affecting the confidentiality of credentials used for IPsec. If an exposed key remains valid and is accepted by the relevant systems, an unauthorized party may be able to authenticate to or interfere with a protected tunnel; the actual outcome depends on the IPsec implementation and the state of the individual key. The supplied assessment indicates a significant integrity impact but does not identify an availability impact. Operational consequences may include emergency key rotation, review of log permissions, investigation of bundle access, and reassessment of connections that depend on the exposed key.

Recording pre-shared keys in logs expands the number of people or systems that may access credentials protecting network tunnels. If a valid key is obtained by an unauthorized party, the organization may need to rotate keys, review log access, and reassess related tunnels. Under the right conditions, a disclosed key could enable unauthorized access to or interference with protected communications, but the available evidence does not confirm a specific breach or intrusion. Retained or shared support bundles should be handled as sensitive credential-bearing data.

1. Install the Brocade SANnav security update provided in 3.0.1a. Do not infer from this record that every later or parallel release branch has been independently verified.
2. Until the update is installed, restrict read access to system logs and support bundles according to least-privilege principles, and control copying or distribution of those files.
3. Review logs and bundles created before the update. If a pre-shared key may have been recorded or read, consider rotating the related keys through the organization's network change process.
4. Check retained backups and bundles shared outside the administrative boundary, treat them as credential-bearing data, and apply appropriate retention or revocation controls.

1. Inventory Brocade SANnav and Brocade SANnav OVA deployments and identify the exact installed build and release branch.
2. Review application logs associated with IPsec policy creation or modification for pre-shared keys or equivalent credential values.
3. Examine retained system logs and support bundles, including bundles shared with third parties, and determine who could read them.
4. If a key appears in a log or bundle, treat it as potentially exposed and follow the applicable key-rotation procedure.
5. As a precaution, review authentication and IPsec change telemetry for unusual activity after a possible exposure. This is general defensive monitoring, not a vendor-confirmed indicator for this issue.