EUVD-2026-94670
GHSA-3whm-p6mj-fpf5
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent management-network reach gives AV:A; the Host-header trust flaw needs no auth or interaction (PR:N/UI:N), and only metadata leaks, so C:L with I:N/A:N.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
3DescriptionCVE.org
An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socket transport layer source IP address. Successful exploitation allows the attacker to bypass IP-filtering access control lists (ACLs) and obtain sensitive device metadata (such as model, serial number, hardware revision, and firmware version) without authentication.
AnalysisAI
Brocade Fabric OS switches running software versions before 10.0.1 can be induced to leak sensitive device metadata (model, serial number, hardware revision, firmware version) to an unauthenticated attacker positioned on an adjacent network segment. The web dispatcher in the management interface decides whether a request originates from a trusted internal management VLAN by reading the client-supplied HTTP Host header rather than the actual TCP socket source IP, so a crafted request can impersonate a trusted internal host and slip past IP-filtering ACLs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to reach the Brocade Fabric OS web server management interface from an adjacent network position (AV:A) and to send crafted HTTP requests whose Host header spoofs a value the web dispatcher treats as belonging to the trusted internal management VLAN. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-to-moderate priority issue, not a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Brocade Fabric OS to version 10.0.1 or later, the first release in which the web dispatcher evaluates management-VLAN trust from the socket transport source address rather than the client-supplied HTTP Host header; follow the Broadcom vendor advisory at https://support.broadcom.com/external/content/SecurityAdvisories/0/39080 for the validated upgrade path and any platform-specific sequencing notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allo
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated,
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privilege
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthen
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the R
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's managem
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to f
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivile
Command injection in the security certificate management component of the Brocade Fabric OS administrative management AP
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today