CVE-2024-2859 is a Medium severity (CVSS 6.8) default permissions flaw in Broadcom Brocade SANnav, where the OVA ships with root login enabled. It is protected by a password but widens exposure. The record gives no versions, so read the Broadcom advisory for the fixed release.
What's affected
- Product: Broadcom Brocade SANnav, delivered as an OVA virtual appliance.
- Affected: the record says SANnav OVA ships with root login enabled by default but lists no version range.
- Fixed: not stated in the record. The Broadcom advisory (SecurityAdvisories 23245) should list it. It returned an access error when we fetched it, so check it directly.
- Weakness: CWE-276.
- Access needed: a high privilege (administrator) account over the network (CVSS vector CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
How to check if you're exposed
- Find your SANnav version in the SANnav web interface or on the appliance.
- Open the Broadcom advisory and compare your version with its affected list.
- On the appliance, check whether the root account can log in over SSH. If you manage the VM,
grep -i PermitRootLogin /etc/ssh/sshd_configshows the SSH setting. - Review who knows or can retrieve the root password.
What to do now
- Read the Broadcom advisory and note the fixed version.
- Upgrade SANnav to the fixed version.
- Disable direct root login and use named accounts with sudo where the product allows it.
- Rotate the root password and store it in a vault.
- Limit network access to the appliance to storage administrators.
Why it matters
Incorrect default permissions mean a product ships in a state that is more open than it should be. Here the weakness is a root login that is enabled out of the box.
Secure defaults matter because many deployments never change them. A password helps, but an enabled root account widens what a single stolen or guessed credential can do.
SANnav manages storage area networks, so access to the host is access to infrastructure that carries all of your data traffic. A default that enables root login means one leaked or guessed password has a large blast radius. The NetApp advisory listed in the references suggests the issue is tracked by other vendors too, but we could not read it.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Try it yourself
Configuration weaknesses depend on how reachable the host is. The exploitability demo shows how to weigh that.
Click through it at your own pace, or open it full screen.
Quick check
Is the root account passwordless?
No. The record says it is protected by a password. The risk is that root access exists at all.
Where are fixed versions listed?
In the Broadcom advisory linked in the sources.
Sources
Record references (both returned access errors when we fetched them):
- https://security.netapp.com/advisory/ntap-20240628-0003/
- https://support.broadcom.com/external/content/SecurityAdvisories/0/23245
Last reviewed: 19 October 2026.
