EUVD-2026-94666
GHSA-jhmq-9587-7vfc
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A matches the vendor's adjacent-network scope for the SNMP management plane; AC:L and PR:N/UI:N reflect an unauthenticated single-packet trigger under default config, with potential code execution yielding C:H/I:H/A:H.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
3DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of the string. A remote, unauthenticated attacker (under default configuration) can exploit this vulnerability by sending a specially crafted SNMPv3 packet, leading to memory corruption, daemon crash (Denial of Service), or potential arbitrary code execution.
AnalysisAI
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthenticated attacker crash or potentially execute code on affected switches by sending a specially crafted SNMPv3 packet. The flaw sits in an internal statistics handler that copies the attacker-supplied SNMPv3 context name into a fixed-size stack buffer without validating its length, producing memory corruption that the vendor says is reachable under default configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the Brocade Fabric OS SNMP daemon be running and processing SNMPv3 packets, which the vendor states is the default configuration, and network reachability to the switch's SNMP service (UDP/161) from an ADJACENT network segment - per CVSS AV:A the attacker must share the switch's management/local broadcast domain rather than reach it from an arbitrary internet host. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible high-priority issue, though not an emergency broadcast event. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Brocade Fabric OS to 10.0.1 or later, which contains the fix for the unchecked context-name copy in the SNMP statistics handler; consult Broadcom/Brocade advisory 39078 (https://support.broadcom.com/external/content/SecurityAdvisories/0/39078) for the platform-specific build and upgrade sequencing across switches and directors. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Brocade Fabric OS switches and identify those running any version prior to 10.0.1; immediately restrict SNMP access (UDP/161) to a dedicated management VLAN and enforce firewall or ACL rules that only permit trusted management hosts, and disable SNMP entirely if not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allo
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated,
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privilege
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the R
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's managem
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to f
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivile
Command injection in the security certificate management component of the Brocade Fabric OS administrative management AP
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0
Authentication bypass in Brocade Fabric OS versions before 9.2.2d running on the MXG610 extension switch lets a network-
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today