EUVD-2026-94677
GHSA-hrhr-45jg-9xm4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires access to a locally generated support bundle (AV:L, PR:L); cleartext credential leakage gives C:H with no integrity or availability impact and no scope change.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
2DescriptionCVE.org
An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support bundle, such as support personnel or users with access to file shares where support bundles are stored, can extract these cleartext proxy credentials.
AnalysisAI
Cleartext storage of HTTP proxy credentials in Brocade Fabric OS SupportLink diagnostic support bundles (all versions before 10.0.1) lets anyone who can read a generated bundle recover the proxy account's username and password. The issue is access-gated rather than network-reachable: it only manifests when SupportLink is configured to use an authenticated HTTP proxy, and the attacker must already have read access to the bundle, either as support personnel handling it or as a user able to reach the file share where bundles are retained. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that SupportLink be configured to use an AUTHENTICATED HTTP proxy - if no proxy, or an unauthenticated proxy, is configured, no credentials are stored and the issue does not apply. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity information-disclosure issue, not a high-urgency priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Brocade Fabric OS 10.0.1, the version threshold stated in the vendor advisory for this issue (advisory: https://support.broadcom.com/external/content/SecurityAdvisories/0/39142); confirm the SupportLink component version after upgrade rather than relying on the base OS image alone. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allo
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated,
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privilege
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthen
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the R
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's managem
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to f
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivile
Command injection in the security certificate management component of the Brocade Fabric OS administrative management AP
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today