CVE-2024-4161 is a high severity (CVSS 8.6) flaw in Brocade SANnav, the storage network management product from Broadcom. Versions before 2.3.0 accept syslog traffic in clear text, so an unauthenticated network attacker could capture sensitive information. The record points to SANnav 2.3.0 as the version that changes this.
What's affected
The NVD record says the issue affects Brocade SANnav before v2.3.0. It does not list individual build numbers, and the CPE entry uses a wildcard for the version, so treat any SANnav release older than 2.3.0 as in scope until the vendor advisory says otherwise.
The record gives a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. In plain terms: reachable over the network, no login, no user interaction, and the impact is a loss of confidentiality that reaches beyond the vulnerable component. There is no integrity or availability impact in this record.
The record does not mark this as exploited in the wild, and CISA's Known Exploited Vulnerabilities list does not include it according to the record's KEV flag.
How to check if you're exposed
Start with the version. Open the SANnav web interface and read the installed version from the product's about or version page, or check your deployment records. Anything below 2.3.0 needs action.
Then look at the syslog path rather than only the software. The weakness is about log data crossing the network unprotected, so list which switches and appliances send syslog to SANnav, over which network segments, and who else can see those segments. A packet capture on the receiving interface will show whether the messages are readable text. Do that only on networks you are authorised to monitor.
If your SANnav is tracked in an SBOM or asset inventory, search it for the product name and version. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related entries.
What to do now
- Confirm the installed SANnav version and compare it with 2.3.0.
- Read Broadcom's advisory 23284 for the exact fixed builds and upgrade notes, then plan the upgrade.
- Until you upgrade, keep syslog traffic to SANnav on an isolated management network and restrict who can reach it.
- Review what the forwarded logs contain, since log lines from storage fabric devices can carry hostnames, account names and configuration detail.
- Record the upgrade and the network restriction in your change log so the exposure window is documented.
Why it matters
The weakness class is CWE-319, cleartext transmission of sensitive information. Syslog over plain UDP or TCP has no confidentiality by design, which is fine on a closed segment and a problem when the receiver sits on a network others can observe. The scope change in the vector reflects that what leaks can belong to other systems, namely the switches and hosts that send their logs to SANnav.
The fix for this class is usually a change in how the receiver accepts traffic, plus network design that keeps management traffic apart. Management platforms for storage networks hold a lot of context about the fabric, so their inbound data feeds deserve the same review as their web login.
Quick check
Does this need a login to exploit?
No. The record's vector shows no privileges required and no user interaction, but the attacker must be able to observe syslog traffic on the network.
Sources
- Broadcom security advisory, listed in the NVD record (23284). The page sat behind a browser challenge and could not be retrieved for this review, so the details below come from the NVD record.
- Safeguard Gold entry for CVE-2024-4161
Last reviewed: 19 October 2026.
