Brocade ASCG CVE-2026-85422

Exploitation requires access to the Brocade ASCG software binaries (version before 3.5.0) from which the static key is extracted, reflected by the vendor's AV:L/PR:H scoring indicating local and high-privilege access to the appliance/software. Once the key is recovered, it is identical across installations, enabling an attacker to decrypt management credentials stored at rest or to forge administrative inter-node synchronization messages that peer nodes trust. Limiting factors: the attacker must already obtain the binaries or privileged local access, and no network-facing, unauthenticated path is indicated; upgrading to ASCG 3.5.0 or later removes the condition. Authentication is required per the vector (PR:H).

This is a hardcoded cryptographic key flaw (CWE-798) in Brocade ASCG before 3.5.0, vendor-scored CVSS 4.0 8.4 (High) with vector AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H. The signals are internally consistent but point to a serious-yet-not-urgent issue: the vector is LOCAL (AV:L) and requires HIGH privileges (PR:H), which tempers the raw 8.4 - this is not a remote unauthenticated takeover. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or probable near-term exploitation. The key tension is that PR:H/AV:L implies an already-privileged local attacker, yet the real danger of a HARDCODED key is that the same static key ships in EVERY installation's binaries: any party who obtains the software can extract the key offline and then use it against OTHER deployments to decrypt at-rest management credentials or forge administrative inter-node synchronization messages. The vendor's AV:L/PR:H scoring appears to model key extraction from a local binary rather than the downstream network abuse of forged sync messages, so the practical blast radius (credential theft, impersonated admin sync) may be broader than the vector alone suggests - verify the inter-node attack surface with Broadcom. Overall: a genuine 'patch it' integrity/confidentiality issue for ASCG operators, but a moderate rather than drop-everything priority given the absence of KEV/EPSS/POC signals and the local/privileged access reflected in the vector.

An attacker obtains the Brocade ASCG software binaries (as a customer, via a compromised appliance, or any local access) and extracts the static hardcoded key embedded to protect data at rest and inter-node communication. Using that key they decrypt stored management credentials from the appliance, or craft forged administrative synchronization messages that other ASCG nodes accept as legitimate. No public exploit identified at time of analysis, so weaponization would require custom reverse-engineering of the binary.