CVE-2024-4282: Critical Weak SSH Setting in Brocade SANnav

CVE-2024-4282 is a critical (CVSS 9.8) weak cryptography flaw in the Brocade SANnav OVA before version 2.3.1b, which enables the deprecated SHA1 setting for SSH on port 22. Upgrade to SANnav 2.3.1b or later and confirm in the Broadcom advisory what changed.

What's affected

Per the NVD record, Brocade SANnav OVA before SANnav 2.3.1b is affected. The appliance enables a deprecated SHA1 setting for SSH on port 22. The fixed release is 2.3.1b or later.

I could not retrieve the Broadcom advisory page, which is linked in the record. The record gives only that single sentence, so the details of what an attacker can do come from the score and not from the text.

The CVSS 9.8 score assumes network access, no privileges and full impact. A deprecated hash algorithm usually weakens the protection of a connection and does not give access on its own. Read the advisory before you decide how to schedule the work.

How to check if you're exposed

Find the SANnav version in the web interface and compare it with 2.3.1b.

You can also see which SSH algorithms the appliance offers. From a management host with OpenSSH installed, list the offered key exchange and MAC algorithms with a verbose connection:

ssh -vv -o BatchMode=yes admin@SANNAV-HOST 2>&1 | grep -i "kex\|mac"

Replace the host name with yours. Look for SHA1 based entries. Follow the Broadcom advisory for the authoritative check.

What to do now

1. Read the Broadcom advisory for CVE-2024-4282 and confirm the fixed release for your deployment.
2. Upgrade SANnav to 2.3.1b or later.
3. Limit SSH access to the appliance to administrator hosts on a management network.
4. Review the SSH algorithms your other storage and network appliances offer, and remove SHA1 where the vendor allows it.
5. Keep SANnav in your asset inventory so version drift shows up.

Why it matters

The class is CWE-327, use of a broken or risky cryptographic algorithm. SHA1 has been deprecated for years because collisions can be found with real effort, and standards bodies tell vendors to move on. In SSH it can appear in the exchange and integrity settings that protect a session.

Storage network management is a sensitive area. SANnav tools administer fibre channel fabrics, and a compromised management plane can disrupt storage. Moving to a supported release and keeping SSH on a restricted network are the best controls.

Quick check

Sources

• Broadcom security advisory 25400 (listed in the CVE record, page could not be retrieved)
• NVD record for CVE-2024-4282

Last reviewed: 19 October 2026.