EUVD-2026-94690
GHSA-866x-57qx-q5cx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H because an administrator role is required; AC:H and UI:R because a crafted config file plus an admin-initiated download are needed; full shell command execution yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
3DescriptionCVE.org
An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host strings, and filenames directly to an internal utility script without sufficient character set validation. Because the local utility fails to sanitize shell metacharacters before processing them in a system shell command, a malicious or compromised configuration file can cause arbitrary operating system commands to be executed on a remote local switch when an administrator initiates a configuration download.
AnalysisAI
OS command injection in Brocade Fabric OS configuration management can allow arbitrary command execution on a switch when an administrator initiates a configuration download using a malicious or compromised configuration file. Affected versions are Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation requires high administrative privileges to start the download and a crafted config containing shell metacharacters in parameters, relay host strings, or filenames. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an administrator with high privileges to initiate a configuration download operation on the switch (PR:H, UI:P); and (2) a malicious or compromised configuration file in which configuration parameters, the user-supplied relay host string, or filenames contain shell metacharacters (AT:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input assigns a CVSS 4.0 base score of 7.3 (HIGH), but the vector itself argues for a materially lower real-world priority than the number suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Brocade Fabric OS 9.2.2d and later for the 9.x branch; for 10.0.0 through 10.0.0a1, a fixed 10.x version is not specified in the input, so consult the Broadcom advisory at https://support.broadcom.com/external/content/SecurityAdvisories/0/39146 for the current 10.x remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Brocade Fabric OS deployments to identify systems running versions before 9.2.2d or 10.0.0 through 10.0.0a1, restrict administrative access to configuration download functions to only essential trusted personnel, enable detailed logging and alerting for configuration download attempts with suspicious parameters or filenames, and consider temporarily disabling the configuration download feature if not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allo
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated,
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privilege
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthen
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the R
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's managem
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to f
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivile
Command injection in the security certificate management component of the Brocade Fabric OS administrative management AP
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today