CVE-2024-2860 is a High severity (CVSS 7.8) incorrect local authentication flaw in the PostgreSQL implementation of Broadcom Brocade SANnav before 2.3.0a. Someone with access to the host VM can read sensitive data in the database. Upgrade to version 2.3.0a or later.
What's affected
- Product: Broadcom Brocade SANnav.
- Affected: versions before 2.3.0a.
- Fixed: 2.3.0a, per the record's wording of "before 2.3.0a". The Broadcom advisory (24260) returned an access error, so confirm there.
- Weakness: CWE-306.
- Access needed: a low privilege account on the local host (CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
How to check if you're exposed
- Read the SANnav version from the web interface or the appliance.
- Any version below 2.3.0a is affected.
- List who has shell access to the VM:
getent passwdand your SSH access policy. - Check hypervisor permissions, since console access to the VM is also access.
What to do now
- Upgrade SANnav to 2.3.0a or later.
- Reduce who can log in to the VM or open its console.
- Review hypervisor roles for the SANnav VM.
- Rotate any credentials stored in the SANnav database if you suspect the host was exposed.
- Check the Broadcom advisory for extra steps.
Why it matters
Missing authentication for a critical function means a sensitive resource can be reached without proving who you are. In this record the exposure is local to the machine hosting the product.
Treat any host that stores a database of sensitive data as part of the product's trust boundary, and limit who can log in to it.
The description says an attacker on the VM can read the PostgreSQL database. A database that trusts any local user turns a low level foothold on the host into access to everything SANnav stores, which can include device credentials and configuration.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Quick check
Can this be exploited from the network?
The record says the attacker must be accessing the VM. The CVSS vector marks it local.
What is the fixed version?
The record says versions before 2.3.0a are affected, so 2.3.0a or later.
Sources
Record reference (it returned an access error when we fetched it):
Last reviewed: 19 October 2026.
