CVE-2024-4173 is a high severity (CVSS 7.6) information exposure in Brocade SANnav. The record says SANnav exposes Kafka on its WAN interface, which could let an unauthenticated attacker mount attacks, including denial of service. The record gives no fixed version, so the Broadcom advisory is the place to confirm the release to install.
What's affected
The NVD record lists Brocade SANnav with a wildcard version, which means the record itself does not say which releases are affected. Do not read that as every release. Read Broadcom advisory 23285 for the affected and fixed versions before you decide.
The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. The attack vector is adjacent network rather than fully remote, no privileges are needed, and the largest impact is on availability. The weakness is tagged CWE-200, exposure of sensitive information to an unauthorized actor.
This CVE was published the same day as CVE-2024-4161, a separate SANnav issue about cleartext syslog. They are different bugs with different advisories, so check both.
How to check if you're exposed
Ask first whether the Kafka listener is reachable from networks it should not be. The practical test is a port reachability check from a host outside the management segment toward the SANnav server. Kafka brokers commonly listen on port 9092, but confirm the port your deployment uses in the vendor documentation instead of assuming it.
Next, check the SANnav version in the web interface and match it to the advisory. Then review firewall rules on the SANnav host and on the network edge for any rule that allows broad access to broker ports.
For tracking across many products, search your inventory for Brocade SANnav. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related entries.
What to do now
- Retrieve Broadcom advisory 23285 and note the affected and fixed SANnav releases.
- Identify the installed version and schedule the upgrade to a fixed release.
- Block access to the Kafka broker port from any network that is not part of the SANnav management design.
- Confirm after the change, with a reachability test, that the port no longer answers from untrusted segments.
- Add SANnav to the list of products that get a quarterly check of listening services.
Why it matters
The record describes a message broker bound to an interface it did not need to be bound to. Brokers like Kafka are built for trusted internal clients, and many deployments carry no authentication on the broker port unless it is configured. When such a service is reachable from a wider network, a stranger can read or disrupt the internal event stream.
The availability rating is the highest part of the vector. A management platform that stops processing events can leave operators without monitoring of a storage network when they most need it. That is the reason to treat an adjacent network issue on a management server as more than a low priority.
Quick check
Is SANnav exploited in the wild for this CVE?
The record's KEV flag is false and no advisory we could retrieve says so. That can change, so check CISA's catalog if you rely on it.
Sources
- Broadcom security advisory, listed in the NVD record (23285). The page sat behind a browser challenge and could not be retrieved for this review, so the details below come from the NVD record.
- Safeguard Gold entry for CVE-2024-4173
Last reviewed: 19 October 2026.
