EUVD-2026-94745
GHSA-hrf2-53wv-vghq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Upgrade action needs admin privileges (PR:H) and an operator-initiated workflow (UI:R) on the local/management plane (AV:L); injected commands run with daemon privileges giving full C/I/A impact, scope unchanged.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
3DescriptionCVE.org
Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control characters and shell metacharacters in fields like the host or file path are not stripped or sanitized, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.
AnalysisAI
Command injection in the Brocade Fabric OS firmware management daemon lets a management user with high privileges execute arbitrary shell commands with the daemon's elevated privileges on switches running Fabric OS before 9.2.2d or 10.0.0 through 10.0.0a1. Because the CVSS vector is local (AV:L), requires high privileges (PR:H) and an operator-driven upgrade workflow (UI:P/UI:R), this is a privilege-boundary flaw for an already-authorized administrator rather than unauthenticated remote takeover, though successful exploitation yields full confidentiality, integrity and availability impact confined to the affected Fabric OS instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to reach the firmware upgrade / download-protocol handler of Brocade Fabric OS and supply malicious shell metacharacters or control characters in the host or file-path parameter fields, which are converted into a system command string and executed via a shell. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional risk rather than a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Fabric OS 9.2.2d (and later 9.x maintenance releases), with the 10.0.0 branch fixed in the release following 10.0.0a1 as directed by the Broadcom advisory (https://support.broadcom.com/external/content/SecurityAdvisories/0/39162); schedule upgrades during a maintenance window because they are disruptive. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Fabric OS switches and identify any running versions before 9.2.2d or 10.0.0 through 10.0.0a1, then confirm the current exposure with Broadcom/Brocade support since no vendor-released patch has been identified at time of analysis, and immediately restrict the population of accounts holding high-privilege Fabric OS management roles to the smallest possible set, enforce multi-factor authentication on the management plane, and confine switch administration to hardened jump hosts on a segmented management VLAN. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allo
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated,
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privilege
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthen
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the R
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's managem
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to f
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivile
Command injection in the security certificate management component of the Brocade Fabric OS administrative management AP
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today