EUVD-2026-94791
GHSA-97j3-qprw-gmrp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local authenticated shell on ASCG OVA
-
ExploitRead script in installation path
-
ExecutionRecover embedded default Brocade credential
-
ImpactAuthenticate and escalate to full appliance control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a local authenticated user account on the host, (2) read access to the ASCG installation path where the distributed script embedding the hard-coded default Brocade password resides, (3) the deployment to be the Open Virtual Appliance (OVA) form factor, and (4) default configuration settings to remain in place - i.e., the default password has not been rotated. Limiting factors that reduce realistic risk: the vector is local only (not remotely reachable), the attacker must already hold valid low-privilege credentials, passive user interaction is required (UI:P), and operators who change the default credential or harden the configuration on affected OVA deployments break the attack. |
| Impact | The input provides a CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H) scoring 7.0 (High). The dominant risk driver is the full confidentiality/integrity/availability impact on the vulnerable system (VC:H/VI:H/VA:H) resulting from privilege escalation via CWE-798 hard-coded credentials. However, the exploitability signals meaningfully constrain real-world risk: the attack vector is local (AV:L), the attacker must already be a low-privileged authenticated user (PR:L), and passive user interaction is required (UI:P). There is no EPSS score, no CISA KEV listing, and no public exploit provided in the input - so this is a high-severity-impact issue but with no evidence of active or widespread exploitation. The reliance on local authenticated access and an unchanged default configuration makes this a real-but-second-tier priority rather than an emergency: it matters most where many low-trust users share access to an ASCG OVA host. Key missing data stated explicitly: EPSS and KEV data are absent (not provided), so exploitation likelihood cannot be quantified from the input; POC status is unknown rather than confirmed negative. |
| Exploit ScenarioDerived | A low-privileged user who already has a local shell on a Brocade ASCG OVA deployment reads an installation-path script that embeds the well-known Brocade default password. Using that recovered credential against a still-default configuration, the user authenticates to a privileged account and escalates to full control of the appliance. No public exploit code was identified in the provided data, and the local, low-privilege, user-interaction-dependent vector (AV:L/PR:L/UI:P) limits this to attackers who already have footholds on the host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Local privilege escalation in Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 stems from a well-known Brocade default password embedded in a script that is distributed to every customer, allowing any local authenticated user with read access to the installation path to recover the credential and elevate privileges on Open Virtual Appliance (OVA) deployments where default configuration settings remain in place. The flaw is rated 7.0 (High) under CVSS 4.0 with a local vector (AV:L, PR:L, UI:P), meaning an attacker must already hold a low-privilege local account and passive user interaction is required, so it is not remotely reachable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic risk is concentrated on OVA deployments that have not rotated the default credential.
RemediationAI
Upgrade Brocade ASCG to 3.5.0 or later - the vendor-released patch for this issue; consult Broadcom/Brocade advisory 38384 (https://support.broadcom.com/external/content/SecurityAdvisories/0/38384) for the exact fixed build, since the input data only establishes that versions before 3.5.0 are affected. Where an immediate upgrade is not possible, the most direct compensating control is to rotate the embedded Brocade default password on every affected ASCG OVA deployment and apply unique, per-instance credentials; the trade-off is that other components or management integrations still expecting the shipped default may lose connectivity until they are updated, and the static secret remains present in the distributed script until the code is replaced. Tighten file-system permissions on the ASCG installation path so that only the ASCG service account and administrators can read it (for example, restrict the directory to root/administrator-owned, mode 0700 or equivalent ACLs); this breaks the read-access precondition but must be validated in a test environment because overly restrictive ownership can prevent the appliance's own processes from starting or updating. Harden the OVA configuration away from its defaults (forced first-boot credential change, disabled unused management interfaces) and audit local accounts for unnecessary low-privilege access to the gateway host, since the attack requires an existing local authenticated user and passive user interaction. Because the vector is local-only with PR:L and UI:P, network segmentation and remote-attack mitigations provide little benefit; prioritization should focus on OVA deployments running ASCG below 3.5.0 with unchanged defaults and unrotated credentials.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-798 (Use of Hard-coded Credentials): the ASCG installer ships a script containing a static, vendor-known Brocade default password rather than generating or prompting for a unique secret per deployment. The affected component is identified by the CPE cpe:2.3:a:brocade:brocade_active_support_connectivity_gateway:*:*:*:*:*:*:*:* (Brocade Active Support Connectivity Gateway), a support/telemetry gateway that is commonly delivered as an Open Virtual Appliance (OVA). Because the credential is stored in a file inside the installation path, the confidentiality boundary is effectively the file-system permission boundary; any local principal with read access to that path - including a non-privileged authenticated account - can harvest the static secret. The default-password design means the same secret is reused across every affected installation, so the confidentiality impact is not limited to a single host, although the assessed vector remains local-only with scope unchanged (SC:N/SI:N/SA:N). Successful recovery of the credential then enables vertical movement to the privileges that secret grants, producing high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) per the CVSS 4.0 vector (7.0). The independent assessment mirrors this with CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, confirming the local, authenticated, user-interaction-dependent exploitation profile.
Know when Brocade Active Support Connectivity Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local read access by an existing low-privileged user (AV:L/PR:L) to recover a hard-coded credential, with passive interaction mapped to UI:R and no scope change (S:U); privilege escalation yields full C:H/I:H/A:H.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
2DescriptionCVE.org
Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.
Executive ViewAI
Organizations running Brocade Active Support Connectivity Gateway (ASCG) OVA deployments with default configuration settings are exposed to a local privilege escalation risk from an embedded default credential in versions before 3.5.0. A low-privileged, authenticated local user with read access to the installation path could recover the credential and gain elevated access, potentially compromising the gateway's support connectivity functions. No public exploit identified at time of analysis, but the risk is concentrated on OVA deployments that have not rotated the default credential, so leadership should prioritize discovery and credential rotation.
No vendor-released patch identified at time of analysis; interim mitigations include rotating the embedded default credential on all Brocade ASCG OVA deployments, restricting local read access to the installation path, enforcing least privilege for local users, removing or protecting the distributed script containing the credential, and monitoring for local privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Brocade Active Support Connectivity Gateway versions up to 3.4.0 contains a vulnerability that allows attackers to an un
Unauthenticated control-plane takeover in the Brocade Active Support Connectivity Gateway (ASCG) HTTPS service allows a
Unauthenticated API access in Brocade ASCG (Active Support Connectivity Gateway) before version 3.5.0 lets an attacker o
Authenticated code injection in Brocade ASCG before 3.5.0 allows network-adjacent attackers with low-privilege accounts
Missing authentication in the Brocade ASCG data collector API endpoint allows an unauthenticated adjacent-network attack
Path traversal in the HTTP service component of Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 allows a
Authentication bypass in Brocade ASCG versions prior to 3.5.0 allows unauthenticated attackers on an adjacent network to
Weak cryptography in Brocade Active Support Connectivity Gateway (ASCG) versions prior to 3.3.0 exposes local communicat
Brocade Active Support Connectivity Gateway (ASCG) builds prior to 3.5.0 embed a static cryptographic key inside shipped
Local credential theft in Brocade ASCG before 3.5.0 allows a low-privileged authenticated user on the ASCG VM to extract
Path traversal in Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 lets an unauthenticated attacker write
Unauthenticated attackers with adjacent-network reachability can push an unauthorized Certificate Authority certificate
Exploit-DB